{"vulnerability": "cve-2026-10058", "sightings": [{"uuid": "97757fbc-16d3-4842-a1e5-8cdffe48ec52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10058", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10942-2b78b-2.html", "content": "", "creation_timestamp": "2026-05-29T01:15:00.000000Z"}, {"uuid": "fc0cb6c7-dd85-4f72-9ff9-580c6d7d3002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100582", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117335105540930772", "content": "CVE-2026-100582 (HIGH): openclaw msteams <2026.8.1 has a missing authorization flaw \u2014 low-trust users can bypass channel read allowlists and access restricted data. Patch to 2026.8.1 ASAP. https://radar.offseq.com/threat/cve-2026-100582-missing-authorization-in-openclaw-msteams-98e504ab6e11afa6 #OffSeq #Vuln #OpenClaw #Security", "creation_timestamp": "2026-09-26T03:00:25.881344Z"}, {"uuid": "9f69aaf7-93b4-4c0e-a41d-e752b18bae7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100582", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwfc6ijy7j2v", "content": "openclaw msteams <2026.8.1 has a HIGH severity bug (CVE-2026-100582) allowing unauthorized channel reads. Upgrade to 2026.8.1+ to block data exposure. https://radar.offseq.com/threat/cve-2026-100582-missing-authorization-in-openclaw-msteams-98e504ab6e11afa6 #OffSeq #Vulnerability #Cybersecurity", "creation_timestamp": "2026-09-26T03:00:27.992966Z"}, {"uuid": "a5e6de0d-d28e-4ca4-9fed-0d77e484cea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100589", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfetlghv424", "content": "\ud83d\udfe0 CVE-2026-100589 - High (8.3)\n\nOpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100589/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:48:03.479116Z"}, {"uuid": "05b541d2-cb7a-49da-935c-34b63fcd5b1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100585", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfetslntp2d", "content": "\ud83d\udfe0 CVE-2026-100585 - High (8)\n\nOpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization r...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100585/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:48:11.686668Z"}, {"uuid": "6c058554-a46b-46f7-badd-a23074f435a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100586", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfetzxipp2d", "content": "\ud83d\udfe0 CVE-2026-100586 - High (8.8)\n\nOpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100586/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:48:18.460681Z"}, {"uuid": "9a0c48d1-e2a6-42fa-845a-aea0eab8ddb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100582", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwfixrjsak2x", "content": "Daily IT Security Digest \u2014 2026-09-26\nmulti-person DMs), CVE-2026-100582 (HIGH, missing authorization in MS Teams channel read allowlist bypass), and CVE-2026-93952 variants affecting Discord integration, the Browser extension relay (DoS), diagnostics-prometheus, and third-party credential routing.", "creation_timestamp": "2026-09-26T05:01:58.077780Z"}, {"uuid": "3240bf4f-155d-4619-8799-507af128538b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100587", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfljrmiah2m", "content": "\ud83d\udfe0 CVE-2026-100587 - High (8.8)\n\nOpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex comp...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100587/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T05:47:50.503059Z"}, {"uuid": "d0420f9e-e0d4-4f20-ae71-12a2d1f7e097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100588", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfljyx37d26", "content": "\ud83d\udfe0 CVE-2026-100588 - High (8.3)\n\nOpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requir...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100588/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T05:47:58.668594Z"}, {"uuid": "4990136c-3239-427c-babe-3901540b1c75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100580", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfllwkaoz25", "content": "\ud83d\udfe0 CVE-2026-100580 - High (8.8)\n\nOpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the mode...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100580/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T05:49:03.676857Z"}, {"uuid": "eceefe94-0d2c-463c-b5e5-3e7a812f9e5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100580", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh5x4hl3725", "content": "CVE-2026-100580 - openclaw\nThe OpenClaw software lets a user schedule tasks with a built\u2011in cron feature. A flaw lets an attacker craft a specially cased request that bypasses the safety check and creates a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T20:50:04.453242Z"}, {"uuid": "46b93024-2416-457e-8ca2-516a17adb6e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100585", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh5x5v3vo2o", "content": "CVE-2026-100585 - openclaw\nThe OpenClaw library (versions before 2026.7.1) does not correctly limit who can approve certain permission prompts. A user who can send commands through the MCP channel can approve or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T20:50:05.566090Z"}, {"uuid": "bab7424f-afae-475a-9d20-442ce2dcd7ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100586", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh6iz35bs2r", "content": "CVE-2026-100586 - openclaw\nIn versions of OpenClaw Codex before 2026.7.1, a user who can send commands but does not own a channel can create a link to the underlying runtime and make it run host\u2011level actions. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T21:00:04.790936Z"}, {"uuid": "1a39fe31-d75a-4ddb-b295-e0edfdfc900e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100587", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh6j2ibvg2q", "content": "CVE-2026-100587 - openclaw\nVersions of OpenClaw released before 2026.7.1 do not check who is requesting a plugin installation. This means anyone can add malicious plugins or run code with the same rights as the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T21:00:06.042439Z"}]}