{"vulnerability": "cve-2026-5806", "sightings": [{"uuid": "09b7b2ae-09f2-4a5f-afe7-c4ccdb678a8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58066", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mrucmd2c4t23", "content": "CVE-2026-58066 - Critical authentication bypass in Rocket.Chat SAML SSO. CVSS 9.8. Upgrade to patched versions immediately. #CVE #RocketChat #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-58066/", "creation_timestamp": "2026-07-30T11:12:09.306816Z"}, {"uuid": "4fd6d70a-0930-45dd-8a17-23a4d0e0a3b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58066", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrtujmg3ak2a", "content": "CVE-2026-58066 - rocket.chat\nRocket.Chat's SAML Single Sign-On feature in older versions did not properly verify user identity, which could allow an attacker to log in as any user. This is a serious issue because\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rocketchat #CVE #infosec", "creation_timestamp": "2026-07-30T07:00:05.847680Z"}, {"uuid": "274cd374-cfb3-45bd-9ec4-8f5b1deca501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58066", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtukzihe22w", "content": "\ud83d\udd34 CVE-2026-58066 - Critical (9.8)\n\nRocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, an...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-58066/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-30T07:00:54.028333Z"}, {"uuid": "9ddf8a21-cfaa-4815-92f3-f48032e95da4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58066", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5uyeklhgo6ixu", "content": "CVE-2026-58066 - Rocket.Chat SAML SSO XML Signature Wrapping Vulnerability\nCVE ID : CVE-2026-58066\n \n Published : July 30, 2026, 6:25 a.m. | 12\u00a0minutes ago\n \n Description : Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10....", "creation_timestamp": "2026-07-30T07:10:21.989923Z"}, {"uuid": "8bdadad2-2691-4472-abbb-d5ff2dfc9478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58061", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117036528234088485", "content": "Bouncy Castle Java 1.85 has been released. It includes fixes to various rather significant vulnerabilities and weaknesses. Some highlights:\n- CVE-2026-8763 - Name Constraints bypass via trailing dot in rfc822Name and URI.- CVE-2026-12803 - KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery).- CVE-2026-12816 - IESEngine stream-mode MAC forgery via length-dependent KDF split.- CVE-2026-58061 - CCM-family modes write plaintext to caller buffer before tag check.- CVE-2026-58062 - Stapled OCSP response accepted without binding to the checked certificate.- CVE-2026-59639 - CMS verifySignatures returns true for SignedData with zero signers.\nhttps://www.bouncycastle.org/resources/new-release-bouncy-castle-java-1-85/\n#infosec #cybersecurity", "creation_timestamp": "2026-08-04T09:28:17.967324Z"}, {"uuid": "f2c82e1e-1e88-4fb3-8fad-5af8f15643bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58062", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117036528234088485", "content": "Bouncy Castle Java 1.85 has been released. It includes fixes to various rather significant vulnerabilities and weaknesses. Some highlights:\n- CVE-2026-8763 - Name Constraints bypass via trailing dot in rfc822Name and URI.- CVE-2026-12803 - KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery).- CVE-2026-12816 - IESEngine stream-mode MAC forgery via length-dependent KDF split.- CVE-2026-58061 - CCM-family modes write plaintext to caller buffer before tag check.- CVE-2026-58062 - Stapled OCSP response accepted without binding to the checked certificate.- CVE-2026-59639 - CMS verifySignatures returns true for SignedData with zero signers.\nhttps://www.bouncycastle.org/resources/new-release-bouncy-castle-java-1-85/\n#infosec #cybersecurity", "creation_timestamp": "2026-08-04T09:28:18.027691Z"}, {"uuid": "aa1c60bf-cc65-4b61-9f24-33971ea4f197", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58062", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6jtjhgyp2l", "content": "CVE-2026-58062\nA security issue in Bouncy Castle for Java allows an attacker to send a fake certificate status response, potentially leading to a man-in-the-middle attack. This issue affects versions of Bouncy Castle for\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-03T12:48:04.440816Z"}, {"uuid": "3cfe24a0-b4d5-44f0-8e79-b2a9ef1b2a04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58062", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms7f7p43zj2p", "content": "CVE-2026-58062 - bouncycastle\nBouncy Castle for Java versions before 1.85, 2.73.12, and certain FIPS versions accept unverified OCSP (Online Certificate Status Protocol) responses. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bouncycastle #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-03T20:58:04.029313Z"}, {"uuid": "537bc5c1-9ae3-4f1b-b26b-82889f1ae9a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58062", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msci4onbo62i", "content": "CVE-2026-58062 - bouncycastle\nBouncy Castle for Java versions before 1.85, 2.73.12, and specific FIPS versions accept OCSP responses that may not be properly verified, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bouncycastle #canonical #UbuntuPro1604LTS #CVE #infosec", "creation_timestamp": "2026-08-05T02:28:04.643724Z"}, {"uuid": "4aaaf00b-8f08-4b1c-b441-3ceaf71da147", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-58067", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-prodotti-veeam-1", "content": "", "creation_timestamp": "2026-08-05T12:45:13.665638Z"}, {"uuid": "297d92eb-d23d-462f-9275-574bddb04810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58067", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3msdlqhfa242p", "content": "\ud83d\udd17 CVE : CVE-2026-58067, CVE-2026-58071, CVE-2026-58072, CVE-2026-58073, CVE-2026-58074, CVE-2026-58075, CVE-2026-64630, CVE-2026-64631, CVE-2026-64633, CVE-2026-64634", "creation_timestamp": "2026-08-05T13:05:27.521030Z"}, {"uuid": "2ad79674-8e3a-43b8-9076-2a5077d643dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58065", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqkatd3dmc2x", "content": "CVE-2026-58065 - Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification\nCVE ID : CVE-2026-58065\n \n Published : July 13, 2026, 4:16 p.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : The Apache Airflow Git provider r...", "creation_timestamp": "2026-07-13T17:48:27.594971Z"}, {"uuid": "25367ecb-e62d-43b4-85e8-809a9abce9e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58065", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mqkcd6u55r2f", "content": "CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification", "creation_timestamp": "2026-07-13T18:15:13.651427Z"}, {"uuid": "a32e6f49-b9b1-4161-877b-f4879c2229e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58065", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkphqrqoe27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58065 \u0432 Apache Airflow: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 Git \u0447\u0435\u0440\u0435\u0437 SSH\n\n\n\nhttps://kripta.biz/posts/464B67D8-A36F-4BC6-BDDE-2495CF76FAFA", "creation_timestamp": "2026-07-13T22:10:25.721220Z"}, {"uuid": "c41e0373-d466-4e66-bdf5-a8e138ddef20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58065", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlcqahvim2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-58065 \u0432 Apache Airflow: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/CE3A9503-AD07-4AB2-864F-30598703122F", "creation_timestamp": "2026-07-14T03:55:11.358658Z"}, {"uuid": "ed32b118-8d75-4d93-a2e3-7dc001ae9216", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58065", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqryiud7c2b", "content": "\u05d7\u05e9\u05d9\u05e4\u05d4: \u05e4\u05d2\u05d9\u05e2\u05d4 \u05e7\u05e9\u05d4 \u05d1-Apache Airflow - CVE-2026-58065 \u05d5\u05de\u05d4 \u05d6\u05d4 \u05d0\u05d5\u05de\u05e8 \u05dc\u05da\n\n\n\nhttps://khesef.xyz/posts/DF3C920F-0C54-436B-B7DF-B65BC96EDAC7", "creation_timestamp": "2026-07-16T08:11:33.338156Z"}]}