{"vulnerability": "cve-2026-5584", "sightings": [{"uuid": "0e8650c9-80f3-4204-85f4-a649d8983e96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5584", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mirix2tc2a2t", "content": "", "creation_timestamp": "2026-04-05T19:40:48.175187Z"}, {"uuid": "b83144ff-4491-4228-9c8c-c1a91b1253a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5584", "type": "published-proof-of-concept", "source": "Telegram/_XSUrmkvCssZQ5ta9ev5Bt6T-wcvTT0U3Un-0awIxLGZfqA", "content": "", "creation_timestamp": "2026-04-05T19:15:28.000000Z"}, {"uuid": "ff3c17e7-6d29-45a7-81d1-f9feca4f6b33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mubu2orz3x2g", "content": "Top 3 CVE for last 7 days:\nCVE-2026-41992: 43 interactions\nCVE-2026-73570: 20 interactions\nCVE-2026-60004: 19 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-53362: 3 interactions\nCVE-2026-47876: 2 interactions\nCVE-2026-55843: 2 interactions\n", "creation_timestamp": "2026-08-30T07:19:26.633884Z"}, {"uuid": "5c42ff0a-b6d3-407d-a8c6-7216cf8da74b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55847", "type": "published-proof-of-concept", "source": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h", "content": "", "creation_timestamp": "2026-06-16T13:42:25.000000Z"}, {"uuid": "ef49b2be-c73d-4dba-982e-8b8813d77be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55846", "type": "published-proof-of-concept", "source": "https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc", "content": "", "creation_timestamp": "2026-06-16T13:40:55.000000Z"}, {"uuid": "36e05411-24cd-428c-ac85-013d0d22a3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mu7tx427gb2d", "content": "CVE-2026-55841 - High severity FortiGate syslog parser flaw in Graylog. CVSS 7.5. Update immediately. #CVE #Graylog #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-55841/", "creation_timestamp": "2026-08-29T12:12:05.142909Z"}, {"uuid": "65968500-ce6e-4ef8-b9e6-fa1f6ce28f1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117178730072615479", "content": "CVE-2026-55841 - High severity FortiGate syslog parser flaw in Graylog. CVSS 7.5. Update immediately. #CVE #Graylog #infosec\nhttps://www.valtersit.com/cve/CVE-2026-55841/", "creation_timestamp": "2026-08-29T12:12:07.334756Z"}, {"uuid": "1c39ea31-72e4-4b1a-8b1d-265197695322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcx6o6zfz2g", "content": "CVE-2026-55843 - Snipe-IT: Improper Privilege Management\nCVE ID : CVE-2026-55843\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission r...", "creation_timestamp": "2026-07-10T20:07:12.650885Z"}, {"uuid": "1809ea19-453e-43d3-9293-0974c35638dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhmz3k6w2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55843 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/17334C4D-D339-4D7E-8D7B-017CFBE1D8A9", "creation_timestamp": "2026-07-11T01:01:34.081476Z"}, {"uuid": "e8ccfbd2-8e1d-4822-9bcc-bbe6ddaae8f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55848", "type": "published-proof-of-concept", "source": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r", "content": "", "creation_timestamp": "2026-08-29T00:35:05.879570Z"}, {"uuid": "83fe3cba-5916-4778-afa3-9c38566ea381", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://gist.github.com/alon710/bca69671d982aa5325684eebc9b91ff4", "content": "# CVE-2026-55843: CVE-2026-55843: Privilege Demotion and Access Control Bypass via Parameter Omission in Snipe-IT\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55843\n\n## Summary\nA comprehensive technical analysis of CVE-2026-55843, an Improper Privilege Management vulnerability (CWE-269) in Snipe-IT versions prior to 8.6.0. The vulnerability allows an authenticated editor or administrator to overwrite and strip the granular or administrative permissions of other users by omitting the permission parameter from profile update payloads. This issue has been resolved in Snipe-IT version 8.6.0.\n\n## TL;DR\nIn Snipe-IT prior to 8.6.0, submitting a user update request without the 'permission' field causes the application to normalize the missing value to an empty array and overwrite the target user's existing permissions, leading to complete privilege demotion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-269\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.0 (High)\n- **EPSS Score**: 0.00540 (Percentile: 43.02%)\n- **Impact**: Privilege Demotion / Integrity & Availability Loss\n- **Exploit Status**: PoC / Integration Tests Public\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Snipe-IT prior to version 8.6.0\n- **Snipe-IT**: < 8.6.0 (Fixed in: `8.6.0`)\n\n## Mitigation\n\n- Upgrade to Snipe-IT version 8.6.0 or newer.\n- Verify API integration scripts to ensure that partial user updates explicitly include or completely avoid touching permission properties.\n- Monitor audit logs for unexpected privilege demotions or empty permission objects.\n\n**Remediation Steps:**\n1. Identify current Snipe-IT version and plan downtime for upgrade.\n2. Apply the update to version 8.6.0 or later using standard Git or composer update processes.\n3. Validate existing user permissions in the database to ensure no previous administrative accounts were inadvertently stripped.\n4. Run integration tests or manual verification checks on user profile update paths.\n\n## References\n\n- [GitHub Fix Commit](https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad)\n- [GitHub Security Advisory](https://github.com/grokability/snipe-it/security/advisories/GHSA-j5g3-42wp-gqm3)\n- [Snipe-IT v8.6.0 Release Notes](https://github.com/grokability/snipe-it/releases/tag/v8.6.0)\n- [NVD CVE Record](https://nvd.nist.gov/vuln/detail/CVE-2026-55843)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-55843)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T06:33:12.683164Z"}, {"uuid": "cc1ce112-832f-44cc-bf60-1f0b2aec2b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mu6pxq7gov2v", "content": "Snipe-IT CVE-2026-55843: UsersController::update passes the permission field through unconditionally, and it normalises to an empty array when absent. Only the superuser and admin keys are conditionally restored, so other permissions go with an update that never named them. #dev", "creation_timestamp": "2026-08-29T01:28:38.141984Z"}, {"uuid": "7e95f04a-6d20-4a94-88d7-eb01b2c46569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55848", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu6l3ivivh26", "content": "\ud83d\udfe0 CVE-2026-55848 - High (8.6)\n\nmapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.3...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55848/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-29T00:00:50.388296Z"}, {"uuid": "99d652aa-293c-489f-bd19-084dd41f5475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu6l3wne2c22", "content": "\ud83d\udfe0 CVE-2026-55841 - High (7.5)\n\nGraylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55841/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-29T00:01:05.352939Z"}, {"uuid": "b2f35b2f-88c1-4097-85e8-ff9169a6b23e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55848", "type": "seen", "source": "https://gist.github.com/alon710/fd6e1d0021286f338be43882b18358f9", "content": "# CVE-2026-55848: CVE-2026-55848: GML Layer XML External Entity (XXE) Injection in MapFish Print\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55848\n\n## Summary\nAn XML External Entity (XXE) vulnerability in MapFish Print allows unauthenticated remote attackers to perform arbitrary local file disclosure and Server-Side Request Forgery (SSRF) by exploiting GML layer URL parameters in requests submitted to the /api/print3/print endpoint.\n\n## TL;DR\nUnauthenticated attackers can exploit the MapFish Print endpoint to read local server files and execute SSRF attacks by pointing the GML layer to a crafted remote XML document.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-611\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.6\n- **Impact**: Arbitrary File Disclosure, SSRF\n- **Exploit Status**: poc\n- **CISA KEV Status**: False\n\n## Affected Systems\n\n- MapFish Print Core Application Suite\n- org.mapfish.print:print-lib Maven package\n- org.mapfish.print:print-servlet Maven package\n- **mapfish-print**: >= 3.0.0, < 3.28.30 (Fixed in: `3.28.30`)\n- **mapfish-print**: >= 3.29.0, < 3.30.32 (Fixed in: `3.30.32`)\n- **mapfish-print**: >= 3.31.0, < 3.31.24 (Fixed in: `3.31.24`)\n- **mapfish-print**: >= 3.32.0, < 3.33.16 (Fixed in: `3.33.16`)\n- **mapfish-print**: >= 4.0.0, < 4.0.5 (Fixed in: `4.0.5`)\n\n## Mitigation\n\n- Upgrade MapFish Print to patched versions (3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5)\n- Restrict egress network access for the MapFish Print host to block outbound entity resolution\n- Disable the GML layer type if it is not required by current application layouts\n- Apply WAF rules to detect and drop print requests containing external URLs within GML layer definitions\n\n**Remediation Steps:**\n1. Identify all MapFish Print deployments and check the current running version in dependency manifests (such as pom.xml or build.gradle files)\n2. Update the mapfish-print dependencies or servlet container packages to the appropriate patched release stream\n3. Verify the configuration of GmlLayer within the deployed service to confirm that external parsing is disabled\n4. Implement network-level egress restrictions to prevent the application from making arbitrary outbound requests\n5. Perform a scan using the provided verification signatures to ensure the endpoint no longer resolves inline DTDs\n\n## References\n\n- [GitHub Security Advisory GHSA-5v29-34h8-v68r](https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r)\n- [CVE-2026-55848 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-55848)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55848) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T07:31:59.149362Z"}, {"uuid": "2ef39dc8-3d14-4823-81bf-2fb7043e5015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55841", "type": "seen", "source": "https://gist.github.com/alon710/ebe5dde178b6da3fe2981f7349adc91f", "content": "# CVE-2026-55841: CVE-2026-55841: Log Evasion and Tampering in Graylog FortiGate Syslog Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55841\n\n## Summary\nA high-severity log evasion and tampering vulnerability in Graylog's FortiGate key-value syslog parser allows unauthenticated remote attackers to modify, delete, or overwrite critical security log fields, potentially bypassing security controls and monitoring systems.\n\n## TL;DR\nUnauthenticated attackers can inject specially crafted syslog packets containing specific key-value structures to strip or overwrite top-level log metadata like source IP addresses, timestamps, and routing info, enabling comprehensive defense evasion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-138: Improper Neutralization of Special Elements\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: N/A (Published 2026)\n- **Exploit Maturity**: PoC / Conceptual\n- **KEV Status**: Not Listed\n- **Impact**: Log Tampering, Evasion of Security Monitoring, Data Loss\n\n## Affected Systems\n\n- Graylog Server\n- Graylog Forwarder\n- FortiGate Syslog Ingestion Pipeline\n- **Graylog Server**: < 6.3.12 (Fixed in: `6.3.12`)\n- **Graylog Server**: >= 7.0.0-alpha.1, < 7.0.7 (Fixed in: `7.0.7`)\n- **Graylog Server**: >= 7.1.0-alpha.1, < 7.1.2 (Fixed in: `7.1.2`)\n- **Graylog Forwarder**: < 7.3.0 (Fixed in: `7.3.0`)\n\n## Mitigation\n\n- Upgrade Graylog Server and Graylog Forwarder to fixed versions immediately.\n- Implement network-level Access Control Lists (ACLs) to restrict syslog input port access.\n- Configure generic raw inputs and parse fields via secure custom pipelines as a temporary alternative.\n\n**Remediation Steps:**\n1. Identify all Graylog Server and Forwarder nodes running FortiGate syslog input codecs.\n2. Apply the software updates to Graylog Server 6.3.12, 7.0.7, 7.1.2, or Graylog Forwarder 7.3.\n3. Restart the Graylog services and verify that the FortiGate inputs are operating using the updated codec.\n4. Verify log integrity by transmitting a simulated payload containing nested equals signs and confirming top-level fields are preserved.\n\n## References\n\n- [GHSA-gqr6-r77p-c2pj](https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-gqr6-r77p-c2pj)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-55841)\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2026-55841)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55841) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T14:31:35.285589Z"}]}