{"vulnerability": "CVE-2026-5557", "sightings": [{"uuid": "616524d6-76b7-4ffd-a861-31152e8068ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5557", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miqqd6o6pl25", "content": "", "creation_timestamp": "2026-04-05T12:20:11.461395Z"}, {"uuid": "a548eb92-562e-4d8c-996d-de6243a8dca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-55570", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mp3brvvwqm2f", "content": "CRITICAL: SiYuan <3.7.0 vulnerable to XSS (CVE-2026-55570) \u2014 desktop client can be fully compromised via OS command execution. Update to 3.7.0+ now. https://radar.offseq.com/threat/cve-2026-55570-cwe-79-improper-neutralization-of-i-34ddb800ffc94efb #OffSeq #XSS #SiYuan", "creation_timestamp": "2026-06-25T01:30:27.519110Z"}, {"uuid": "b0c4ea43-c9fb-4212-8791-8fae3996fdac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-55570", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116808156714813443", "content": "CVE-2026-55570: CRITICAL XSS in SiYuan (<3.7.0) enables arbitrary HTML injection. On the desktop client, attackers can escalate to OS command execution due to nodeIntegration. Upgrade to 3.7.0+ now! https://radar.offseq.com/threat/cve-2026-55570-cwe-79-improper-neutralization-of-i-34ddb800ffc94efb #OffSeq #XSS #Vuln #SiYuan", "creation_timestamp": "2026-06-25T01:30:35.953530Z"}, {"uuid": "b7919bb2-668a-4f11-9f66-54e166dce529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55570", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp3cbffawf2p", "content": "CVE-2026-55570 - SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)\nCVE ID : CVE-2026-55570\n \n Published : June 24, 2026, 9:24 p.m. | 3\u00a0hours, 46\u00a0minutes ago\n \n Description : SiYuan is an open...", "creation_timestamp": "2026-06-25T01:39:07.469839Z"}, {"uuid": "0af8bcfa-20d4-4ebf-9dc4-53c6b3fa3d96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55577", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpmcy6rdbd27", "content": "CVE-2026-55577 - ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder\nCVE ID : CVE-2026-55577\n \n Published : July 1, 2026, 6:56 p.m. | 50\u00a0minutes ago\n \n Description : ImageMagick is free and open-source software used for editing and manipulating digital images. Prior t...", "creation_timestamp": "2026-07-01T20:07:06.532345Z"}, {"uuid": "a59392e1-b68d-41f6-8b4b-7c570e446eb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55577", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt3c4ngk2r", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55577 \u0432 ImageMagick: \u0443\u0433\u0440\u043e\u0437\u044b, \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/589ABDB3-1FF3-429C-989E-1A131BA85619", "creation_timestamp": "2026-07-02T10:27:49.937608Z"}, {"uuid": "4490a086-132f-4448-96df-9562a46812c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55577", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnxuqsmjt2n", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55577 \u0432 ImageMagick: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/3DAA2BAB-1690-4A1A-94AC-8077FE847EE5", "creation_timestamp": "2026-07-02T11:53:58.433996Z"}, {"uuid": "24380e09-a466-404b-b673-830c600af700", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55577", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnhpwqp52f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55577 \u0432 ImageMagick: \u0443\u0433\u0440\u043e\u0437\u044b, \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/0C557DEC-0F30-40BA-9834-BA8A9642BBDD", "creation_timestamp": "2026-07-03T13:25:23.957559Z"}, {"uuid": "b18424a2-f578-4c72-a48f-3272b9da6156", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55575", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq63262wym27", "content": "CVE-2026-55575 - LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce\nCVE ID : CVE-2026-55575\n \n Published : July 8, 2026, 8:16 p.m. | 58\u00a0minutes ago\n \n Description : LiquidJS is a Shopify / GitHub Pages compatible template engine in ...", "creation_timestamp": "2026-07-08T21:32:58.055779Z"}, {"uuid": "3c348cde-cb67-44e2-b571-c52fb9a10cac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55574", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqa4npejew2n", "content": "\ud83d\udccc CVE-2026-55574 - vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter pass... https://www.cyberhub.blog/cves/CVE-2026-55574", "creation_timestamp": "2026-07-09T17:07:07.056374Z"}, {"uuid": "45c6b734-0768-448c-b9f3-1f67c7818fe1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55576", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpwwfqvfb2l", "content": "CVE-2026-55576 - MaaAssistantArknights: PR-title expression injection in release-preparation.yml\nCVE ID : CVE-2026-55576\n \n Published : July 15, 2026, 10:17 p.m. | 17\u00a0minutes ago\n \n Description : MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the curre...", "creation_timestamp": "2026-07-16T00:07:11.949577Z"}, {"uuid": "8e371daa-4070-4b4d-a54f-57ea678c8152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55579", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqs4ly7n6q2w", "content": "CVE-2026-55579 - pheditor\nPheditor's default 'admin' password is hardcoded and cannot be changed. This allows attackers to access the entire application, including file editing, uploading, and executing\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#pheditor #composer #CVE #infosec", "creation_timestamp": "2026-07-16T20:54:04.402013Z"}, {"uuid": "8ecda82a-76d0-4e1d-bd64-8b86e90a83ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55579", "type": "published-proof-of-concept", "source": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2", "content": "", "creation_timestamp": "2026-07-16T22:35:03.258828Z"}, {"uuid": "dad1f2fb-96a5-4600-8ab6-7bbbebb87613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55578", "type": "published-proof-of-concept", "source": "https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc", "content": "", "creation_timestamp": "2026-07-16T22:35:05.445972Z"}, {"uuid": "0cba9361-4094-499a-bb9e-41d66a7862d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55579", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93769", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-55579\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ch4120N\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-17 01:57:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-55579 \u2013 Unauthenticated RCE in Pheditor via hardcoded default password \"admin\". Full Python exploit with file upload & terminal execution. No dependencies.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T03:00:04.820828Z"}, {"uuid": "f3876640-23e2-419a-a33e-03f8b9f47918", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55579", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93769", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-55579\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ch4120N\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-17 01:57:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-55579 \u2013 Unauthenticated RCE in Pheditor via hardcoded default password \"admin\". Full Python exploit with file upload & terminal execution. No dependencies.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T00:00:43.509082Z"}, {"uuid": "c60aa044-5b5a-45ce-9324-0e9efd037420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55579", "type": "seen", "source": "Telegram/fgcQmUZZFo8ynkgEsbXn8bKh9aNmXTZblUFJMTCuv-35gsk", "content": "", "creation_timestamp": "2026-07-20T18:00:06.618415Z"}, {"uuid": "a7928266-b6a4-412e-82ed-2797108e86bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55579", "type": "seen", "source": "Telegram/fgcQmUZZFo8ynkgEsbXn8bKh9aNmXTZblUFJMTCuv-35gsk", "content": "", "creation_timestamp": "2026-07-21T00:00:34.453637Z"}, {"uuid": "a7042e84-9fed-4250-aaf9-01f2f95662b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55579", "type": "seen", "source": "Telegram/fgcQmUZZFo8ynkgEsbXn8bKh9aNmXTZblUFJMTCuv-35gsk", "content": "", "creation_timestamp": "2026-07-22T01:00:04.441715Z"}, {"uuid": "c5aa26d4-ad3b-4197-b49a-fe20f1ad619a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55575", "type": "published-proof-of-concept", "source": "https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p", "content": "", "creation_timestamp": "2026-07-24T16:35:21.661438Z"}]}