{"vulnerability": "CVE-2026-89086", "sightings": [{"uuid": "3364cac4-1f22-4da3-96ba-e813c0e428b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89086", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6x2w74gh24", "content": "\ud83d\udd34 CVE-2026-89086 - Critical (9.1)\n\nIn the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only conf...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89086/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-10T21:00:27.184168Z"}, {"uuid": "127776dd-dd89-4629-a1c1-fa73e2982834", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89086", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv72tzbqc522", "content": "\ud83d\udea8 CVE-2026-89086 \u2014 CVSS 9.1 CRITICAL\n\nIn the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that P...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89086\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T22:08:09.604316Z"}, {"uuid": "6045e87e-e287-4007-8419-5a4be61432e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89086", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv73jddkdh2j", "content": "CVE-2026-89086 - jose\nThe jose software for OCaml versions earlier than 0.11.0 can mistakenly treat an RSA signature as valid even when it was not created with the correct public key. This means an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jose #ocaml #CVE #infosec", "creation_timestamp": "2026-09-10T22:20:04.729346Z"}, {"uuid": "b69bf216-3d65-4909-9a81-4c9a7e7d8b1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89086", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvaegv3crq2t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-89086: In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed\u2026\nCVSS 9.1\nhttps://beta.vulnsea.com/cve/CVE-2026-89086\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T10:32:26.086828Z"}]}