{"vulnerability": "cve-2026-4557", "sightings": [{"uuid": "a10493be-5753-4a1a-ae8a-5c56b0374da8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4557", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mho4qkxbic2u", "content": "", "creation_timestamp": "2026-03-22T17:59:14.604448Z"}, {"uuid": "60693a7f-4aec-4cdf-8c23-5d934ef73c3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45571", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mmd7wfyspm22", "content": "flux2 2.8.8 patches CVE-2026-45571\ngo-git v5.19.1 fixes CVEs affecting Flux source and image-automation controllers.\nUpgrade carefully.\n\n\u2192 releaseport.com/r/fluxcd-flux2/v2-8-8", "creation_timestamp": "2026-05-21T01:02:53.358085Z"}, {"uuid": "e505a543-1378-474d-b077-ef5263d7065d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45574", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mms3xqtamf2e", "content": "\ud83d\udfe0 CVE-2026-45574 - High (8.1)\n\nepa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-45574/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-26T23:01:59.412113Z"}, {"uuid": "606d2c57-2e4d-41ae-ac77-0258a7df3674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45574", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmsdxxcrxo2r", "content": "CVE-2026-45574 - epa4all-client: TLS Certificate Validation Disabled in Production\nCVE ID : CVE-2026-45574\n \n Published : May 26, 2026, 10:16 p.m. | 2\u00a0hours, 15\u00a0minutes ago\n \n Description : epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur....", "creation_timestamp": "2026-05-27T01:25:15.675847Z"}, {"uuid": "fe2c4c92-a9a5-4feb-a3a7-d171a4f05546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmysj634ah27", "content": "\ud83d\udfe0 CVE-2026-45578 - High (8.8)\n\nWWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metac...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-45578/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T15:01:24.512097Z"}, {"uuid": "9855650c-94ef-44ad-9c0d-646dcf3c0622", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmyungunn52c", "content": "CVE-2026-45578 - WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL\nCVE ID : CVE-2026-45578\n \n Published : May 29, 2026, 2:16 p.m. | 55\u00a0minutes ago\n \n Description : WWBN AVideo is an open source video platform. In 29.0 and earlier, there ...", "creation_timestamp": "2026-05-29T15:39:35.006228Z"}, {"uuid": "d50da2df-d105-45a4-842f-27447f7e363e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45570", "type": "seen", "source": "https://bsky.app/profile/vulny-app.bsky.social/post/3mtmtndjnpz2d", "content": "A critical-severity fix just shipped for Go-Git Project Go-Git. If your stack uses it, patch to the fixed release soon. Quietly closes the gap before anyone goes looking. CVE-2026-45570", "creation_timestamp": "2026-08-21T22:46:03.639834Z"}, {"uuid": "daf629fe-5d76-48f5-a108-0e5aa57ed2eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45570", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motn5ulxzi2s", "content": "\ud83d\udea8  ALERT: CVE-2026-45570\n\nCVSS 9.6/10\n\n\ud83d\udccb WHAT IT IS:\ngo-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes emb", "creation_timestamp": "2026-06-22T00:32:40.625539Z"}, {"uuid": "c54e105b-ea66-4877-8e4e-48a6028081a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45579", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqkahvtkce22", "content": "CVE-2026-45579 - dirac\nAn authenticated user can run commands on the DIRAC server, which allows them to access sensitive information, delete evidence, and potentially take control of the system. This is due to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#dirac #pip #CVE #infosec", "creation_timestamp": "2026-07-13T17:42:04.738751Z"}, {"uuid": "8efb88ec-18f9-4d8f-aa19-d98da7749de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45576", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvhepsbd2n", "content": "CVE-2026-45576 - zrok copy writes attacker-controlled WebDAV paths outside the destination root\nCVE ID : CVE-2026-45576\n \n Published : July 16, 2026, 5:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : zrok is software for sharing web services, files, and network resources. Fr...", "creation_timestamp": "2026-07-16T18:46:13.508308Z"}, {"uuid": "af61edee-cc4e-4d22-aa14-532e8658bc07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4fk6afcg2l", "content": "\ud83d\udd34 CVE-2026-64625 - Critical (9.8)\n\nAVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escap...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-64625/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T23:00:44.995558Z"}, {"uuid": "5eda6521-1896-4901-9189-932ccb5336ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr4iuofsq62x", "content": "CVE-2026-64625 - AVideo before 29.0 OS Command Injection via execAsync\nCVE ID : CVE-2026-64625\n \n Published : July 20, 2026, 10:17 p.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped...", "creation_timestamp": "2026-07-21T00:00:18.454499Z"}, {"uuid": "3cffe132-a277-40c3-a0c0-db3f7d80eeae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3mr4iv57n6w2g", "content": "\ud83d\udea8 EUVD-2026-46119\n\ud83d\udcca 9.3/10\n\ud83c\udfe2 WWBN\n\n\ud83d\udcdd AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substit...\n\n\ud83d\udd17 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46119\n\n#cybersecurity #infosec #cve #euvd", "creation_timestamp": "2026-07-21T00:00:33.762092Z"}, {"uuid": "fdca0931-f037-4177-a1d0-8f9aaab416d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mr4jgdrpjg2b", "content": "One Bad Quote Turns AVideo Into A Remote Shell Factory\nPANIC 88% | Lag 0.0h | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578: execAsync() can re-wrap escaped co\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-21T00:10:11.111691Z"}, {"uuid": "8751afb4-9bb1-4da6-a798-9a2b72a7fcf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45576", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr6car56u322", "content": "\ud83d\udccc CVE-2026-45576 - zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zr... https://www.cyberhub.blog/cves/CVE-2026-45576", "creation_timestamp": "2026-07-21T17:07:06.971168Z"}]}