{"vulnerability": "cve-2026-5577", "sightings": [{"uuid": "b952591f-5c31-4a58-ab9d-a5ee3e070d7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5577", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mirf7byob52k", "content": "", "creation_timestamp": "2026-04-05T18:33:49.726440Z"}, {"uuid": "a07dd7f5-4384-44ca-8b2f-4e52746a5a00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5577", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mirkdt7wn42n", "content": "", "creation_timestamp": "2026-04-05T20:05:50.360402Z"}, {"uuid": "c3f92577-c005-4aa0-8d1a-4a1597b178b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5577", "type": "published-proof-of-concept", "source": "Telegram/gzCKNO_bz4im4uV-yc9tEdz-C82sp4ablGsaOO-Gqtulpb0", "content": "", "creation_timestamp": "2026-04-05T17:15:47.000000Z"}, {"uuid": "20e4a444-4886-4f16-a41c-358031de1119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55775", "type": "published-proof-of-concept", "source": "https://github.com/openbao/openbao/security/advisories/GHSA-mwr2-wmgp-crj6", "content": "", "creation_timestamp": "2026-06-19T11:28:42.000000Z"}, {"uuid": "f80bbf20-4401-4b7a-a477-68a83aa4a7d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55770", "type": "published-proof-of-concept", "source": "https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9", "content": "", "creation_timestamp": "2026-06-19T11:28:09.000000Z"}, {"uuid": "75f0ceac-968c-48f2-aa75-a97cfcc9e32a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55772", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqkiaynjc32c", "content": "\ud83d\udfe0 CVE-2026-55772 - High (8.8)\n\nCedarJava is an open source Java implementation of the Cedar policy language, used for fine-grain...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55772/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-13T20:01:23.015794Z"}, {"uuid": "f6f031b1-03b8-49cc-8d2c-47b7f831072e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55771", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqkllprtr22c", "content": "\ud83d\udfe0 CVE-2026-55771 - High (8.8)\n\nCedarJava is an open source Java implementation of the Cedar policy language, used for fine-grain...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55771/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-13T21:01:04.062023Z"}, {"uuid": "98d97b05-b1c0-47c5-887c-ab55525b7b3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55773", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqkllwplkm2l", "content": "\ud83d\udfe0 CVE-2026-55773 - High (8.8)\n\nCedarJava is an open source Java implementation of the Cedar policy language, used for fine-grain...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55773/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-13T21:01:11.376484Z"}, {"uuid": "9d68dfba-1e03-4da1-a26d-f1ae533c18dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55773", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqkoqqunqx2l", "content": "CVE-2026-55773 - CedarJava has a policy injection vulnerability\nCVE ID : CVE-2026-55773\n \n Published : July 13, 2026, 8:16 p.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authori...", "creation_timestamp": "2026-07-13T21:57:33.867056Z"}, {"uuid": "1848a293-5305-45eb-9663-d61b845c8e39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55772", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqkpi3vawq27", "content": "CVE-2026-55772 - CedarJava has a type confusion vulnerability\nCVE ID : CVE-2026-55772\n \n Published : July 13, 2026, 7:17 p.m. | 2\u00a0hours, 13\u00a0minutes ago\n \n Description : CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authoriz...", "creation_timestamp": "2026-07-13T22:10:37.014932Z"}, {"uuid": "6c018611-a1df-4d6a-9789-fb82447d161d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55771", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqkqcx5wqd2e", "content": "CVE-2026-55771 - CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities\nCVE ID : CVE-2026-55771\n \n Published : July 13, 2026, 8:16 p.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : CedarJava is an open source Java implementation of the C...", "creation_timestamp": "2026-07-13T22:25:38.362543Z"}, {"uuid": "4bbc47bc-8ee4-438b-bcbe-396b709917b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55779", "type": "seen", "source": "https://gist.github.com/alon710/9e3bb6e078cacafc1d284d829bce0078", "content": "# CVE-2026-55779: CVE-2026-55779: Stored Cross-Site Scripting (XSS) in Silverstripe Archive Admin Restore\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55779\n\n## Summary\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the silverstripe/versioned package prior to version 3.2.1. When an administrator restores an archived page containing a crafted Title or URLSegment, the generated restoration message is rendered as CAST_HTML without proper sanitization. This allows malicious JavaScript to execute in the administrator's browser session, compromising the confidentiality and integrity of the CMS dashboard.\n\n## TL;DR\nUnescaped user input in the RestoreAction helper leads to stored XSS inside the Silverstripe CMS administrative interface during page restoration actions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: Not Available\n- **Impact**: Stored Cross-Site Scripting / Session Hijacking\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Silverstripe CMS\n- Silverstripe Versioned Module\n- **silverstripe/versioned**: < 3.2.1 (Fixed in: `3.2.1`)\n\n## Mitigation\n\n- Upgrade silverstripe/versioned dependency to 3.2.1 or higher.\n- Perform manual XML escaping via Convert::raw2xml inside RestoreAction.php as a hotfix.\n- Audit versioned database tables for HTML tags and attribute payloads.\n\n**Remediation Steps:**\n1. Run 'composer update silverstripe/versioned' to pull the patched version.\n2. Verify in composer.lock that the installed version is 3.2.1 or higher.\n3. Execute detection SQL queries on SiteTree_Versions table to identify persistent payloads.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/silverstripe/silverstripe-versioned/security/advisories/GHSA-m4g4-86qc-v8w7)\n- [Pull Request #541](https://github.com/silverstripe/silverstripe-versioned/pull/541)\n- [Fix Commit](https://github.com/silverstripe/silverstripe-versioned/commit/6e30a2cf8d4b9233690464da61bd0fc4d3e92952)\n- [Test Commit](https://github.com/silverstripe/silverstripe-versioned/commit/03c15b3cf71f3fafa330c5af533e7dd3652b5456)\n- [Release 3.2.1](https://github.com/silverstripe/silverstripe-versioned/releases/tag/3.2.1)\n- [Silverstripe Security Release](https://www.silverstripe.org/download/security-releases/cve-2026-55779)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55779) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T10:32:30.962209Z"}]}