{"vulnerability": "CVE-2026-1557", "sightings": [{"uuid": "6c7d0168-d27a-4f59-964f-1f36d0a0ca26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1557", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqkniyyq22s", "content": "", "creation_timestamp": "2026-02-26T06:23:01.282538Z"}, {"uuid": "79647047-0676-41ca-a99a-503a6497cf05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1557", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mhef4mb5j22w", "content": "", "creation_timestamp": "2026-03-18T21:02:32.267988Z"}, {"uuid": "7eaa1b83-74d0-4129-b2db-c6b8afa217ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15573", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3msdytdptqw22", "content": "Keycloak\u306eAuthorization Services\u306b\u8106\u5f31\u6027\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002PathMatcher\u304cURI\u3092\u6b63\u898f\u5316\u305b\u305a\u306b\u6bd4\u8f03\u3059\u308b\u305f\u3081\u3001\u8a8d\u8a3c\u6e08\u307f\u30e6\u30fc\u30b6\u30fc\u304c\u6a29\u9650\u306e\u306a\u3044\u7ba1\u7406/\u5236\u9650\u9818\u57df\u3078\u30a2\u30af\u30bb\u30b9\u2026\nCVE-2026-15573 CVSS 8.1 | HIGH", "creation_timestamp": "2026-08-05T16:59:43.013992Z"}, {"uuid": "cc633e13-c453-44d9-baea-b36045106159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15573", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msen4mf5qq2x", "content": "CVE-2026-15573 - High severity auth bypass in Red Hat Keycloak. URI normalization flaw lets authenticated users bypass policies to access restricted areas. CVSS 8.1. Unpatched - update when available. #CVE #Keycloak #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-15573/", "creation_timestamp": "2026-08-05T23:02:49.217095Z"}, {"uuid": "759862f0-a5b2-4da7-9604-d3690d427d57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15573", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117045393405816451", "content": "CVE-2026-15573 - High severity auth bypass in Red Hat Keycloak. URI normalization flaw lets authenticated users bypass policies to access restricted areas. CVSS 8.1. Unpatched - update when available. #CVE #Keycloak #infosec\nhttps://www.valtersit.com/cve/CVE-2026-15573/", "creation_timestamp": "2026-08-05T23:02:49.604923Z"}, {"uuid": "037015f1-8c95-4c31-bd61-cdec03b73f04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15573", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mserr6omzo26", "content": "Keycloak Bypassed Again While Bureaucracy Waits For The Next Memo\nPANIC 68% | Lag 0.0h | CVE-2026-15573 is a high-severity authorization bypass in Red Hat Keycloak caused by a URI normaliza\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-06T00:25:54.334181Z"}, {"uuid": "f8f92f82-4925-4ba6-b1bd-ec1b38b04afe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15572", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3msg4hotxsw2a", "content": "\ud83d\udd17 CVE : CVE-2026-15572, CVE-2026-15573, CVE-2026-16071, CVE-2026-16100, CVE-2026-16102, CVE-2026-16442, CVE-2026-16443", "creation_timestamp": "2026-08-06T13:10:06.691416Z"}, {"uuid": "e0b419b3-55a3-46b5-b9be-45838db8c88d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15573", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3msg4hotxsw2a", "content": "\ud83d\udd17 CVE : CVE-2026-15572, CVE-2026-15573, CVE-2026-16071, CVE-2026-16100, CVE-2026-16102, CVE-2026-16442, CVE-2026-16443", "creation_timestamp": "2026-08-06T13:10:06.753609Z"}, {"uuid": "c2dcdf34-f1cd-4719-80b6-a0d1a61dcfd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15573", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msrx5vsckp2o", "content": "\ud83d\udccc CVE-2026-15573 - A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does no... https://www.cyberhub.blog/cves/CVE-2026-15573", "creation_timestamp": "2026-08-11T06:07:07.293661Z"}, {"uuid": "0c872bea-7e88-48dc-9496-94e4cab312b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15572", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msrorot2pu2b", "content": "\ud83d\udccc CVE-2026-15572 - A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The \"Allowed Protocol Mapper Types\" policy, which restric... https://www.cyberhub.blog/cves/CVE-2026-15572", "creation_timestamp": "2026-08-11T03:37:07.248490Z"}, {"uuid": "e9131409-1642-4c04-8301-1b785958973d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15574", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjg4qea2f2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-15574 \u0432 vllm-orchestrator-gateway: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/813B30C2-E670-44C9-BB29-9418ED9C1D2E", "creation_timestamp": "2026-07-13T09:50:32.656088Z"}, {"uuid": "b2b1b4fe-e514-45a3-a527-e2cf570d47ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15574", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqjg4wv44l2k", "content": "CVE-2026-15574 - Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default\nCVE ID : CVE-2026-15574\n \n Published : July 13, 2026, 8:01 a.m. | 1\u00a0hour, 28\u00a0minutes ago\n \n Description : A flaw was found in t...", "creation_timestamp": "2026-07-13T09:50:39.257677Z"}, {"uuid": "7187ce24-d7b0-43c9-aed5-de10e4730ebe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15574", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkzk64pyu2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-15574 \u0432 vllm-orchestrator-gateway: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\n\nhttps://kripta.biz/posts/0871CAB3-4E5B-43DB-B56D-F4CCF8AABF0E", "creation_timestamp": "2026-07-14T01:10:43.847538Z"}, {"uuid": "f0258309-2eab-4be6-9d62-3cd317c0e386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15570", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/52swiyiou23na", "content": "CVE-2026-15570 - Improper URL Scheme and Destination Validation in SmartCenter browserseturl Command\nCVE ID : CVE-2026-15570\n \n Published : Aug. 7, 2026, 1:32 p.m. | 49\u00a0minutes ago\n \n Description : An improper restriction of URL schemes and destinations in the SmartCenter brow...", "creation_timestamp": "2026-08-07T14:39:07.008826Z"}, {"uuid": "63c29bcf-e25c-4d27-a6f2-2084020bbe98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15571", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mtvtwiw3pf26", "content": "\ud83d\udd17 CVE : CVE-2026-14613, CVE-2026-15571, CVE-2026-15945, CVE-2026-17048, CVE-2026-18963, CVE-2026-45292, CVE-2026-59888, CVE-2026-59889", "creation_timestamp": "2026-08-25T12:45:08.338574Z"}, {"uuid": "5c86b4cc-b76a-4657-aa9f-c1c31d16a4ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15579", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3l4d5wvgdauoe", "content": "CVE-2026-15579 - Ethernet Switch Web Interface Buffer Overflow Denial of Service\nCVE ID : CVE-2026-15579\n \n Published : Sept. 18, 2026, 10:17 a.m. | 56\u00a0minutes ago\n \n Description : An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper...", "creation_timestamp": "2026-09-18T11:32:34.828958Z"}, {"uuid": "ecc35b58-5080-434f-b80e-8d9b7967fe86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15579", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mvsgo3vnl423", "content": "\ud83d\udd17 CVE : CVE-2026-15579", "creation_timestamp": "2026-09-18T15:00:10.657307Z"}, {"uuid": "e59c55ac-6d53-4403-9678-4ad5a6221c37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15579", "type": "seen", "source": "https://gist.github.com/ichintu/a37032d4209bee987101439e7254e730", "content": "This daily cybersecurity digest highlights emerging threats, critical vulnerabilities, and vendor advisories from September 2026:\n\n**Active Threats & Campaigns**\n- **Transparent Tribe (APT36):** Pakistan-linked group deploying new Rust-based backdoors targeting Indian and Afghan government/defense entities.\n- **GhostCode Phishing:** Exploits Microsoft 365\u2019s OAuth device authorization flow to capture tokens, persistently register devices via Intune/Azure AD, and maintain up to 14 days of SSO-equivalent access.\n- **Teams Impersonation:** Attackers use default external chats to deliver malicious MSI files that steal passwords via fake Windows lock screens.\n\n**Critical Vulnerabilities & Advisories**\n- **AI Coding Agents:** \u201cPlugin4Shell\u201d exposes a zero-click RCE flaw in Anthropic, OpenAI, Google, and GitHub agents by bypassing Git SHA validation. Anthropic and OpenAI are patched; GitHub remains partially exposed.\n- **Network/ICS:** Moxa and Advantech issued advisories for Ethernet switches vulnerable to CVE-2026-15579 (buffer overflow causing DoS).\n- **Enterprise & Browser:** NetBackup Flex OS has a critical (9.4) privilege escalation flaw (CVE-2026-28197). Grafana OSS (v12.3.0\u201313.2.1) contains a Geomap XSS vulnerability. Google Chrome (<153.0.8010.53) requires urgent patching.\n\n**Key Defensive Actions**\nApply all vendor patches immediately, restrict device-code authentication via Conditional Access, disable default Teams external chats for non-essential users, and monitor AI agent plugin installations alongside EDR/CI-CD logs for anomalous activity.", "creation_timestamp": "2026-09-18T16:02:06.712338Z"}, {"uuid": "70677707-99ce-44d3-ad9e-d26e4733ab4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15579", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvskfw7gtm2j", "content": "~Cybergcca~\nGrafana, Advantech, Moxa and Chrome users should apply available updates.\n-\nIOCs: CVE-2026-15579\n-\n#CVE202615579 #ThreatIntel #Vulnerability", "creation_timestamp": "2026-09-18T16:07:11.711951Z"}, {"uuid": "596e99f9-b6bc-41e0-97b2-0c90ff9b1bcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-15579", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-938", "content": "", "creation_timestamp": "2026-09-18T16:15:08.484712Z"}]}