{"vulnerability": "cve-2026-10055", "sightings": [{"uuid": "14a4a089-ce35-4c61-8706-869148d9c75c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10055", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpqgb2rrz72w", "content": "CVE-2026-10055 - Eclipse Theia Request Service Server-Side Request Forgery\nCVE ID : CVE-2026-10055\n \n Published : July 3, 2026, 10:30 a.m. | 42\u00a0minutes ago\n \n Description : In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-con...", "creation_timestamp": "2026-07-03T11:16:24.121212Z"}, {"uuid": "c9f72b48-f972-4b6b-b866-91f9103533a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10055", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116855932778535722", "content": "Server-Side Request Forgery (SSRF) in Eclipse Theia 1.26.0 (CVE-2026-10055, HIGH, CVSS 8.5). Attackers with access to the service connection can target internal resources. Restrict access now. https://radar.offseq.com/threat/cve-2026-10055-cwe-918-server-side-request-forgery-66116bce3c83a4f6 #OffSeq #SSRF #EclipseTheia #Cybersecurity", "creation_timestamp": "2026-07-03T12:00:29.708411Z"}, {"uuid": "fd93f6db-c9d4-470d-b877-f5341e8179c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-10055", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mpqipwypqs2t", "content": "SSRF flaw (HIGH, CVE-2026-10055) in Eclipse Theia 1.26.0 lets attackers reach internal endpoints if service is exposed to untrusted users. Restrict access until a fix is available. https://radar.offseq.com/threat/cve-2026-10055-cwe-918-server-side-request-forgery-66116bce3c83a4f6 #OffSeq #SSRF #E...", "creation_timestamp": "2026-07-03T12:00:33.050505Z"}, {"uuid": "689fbcc8-a191-4247-a0f2-9d7665b62ed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10055", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mprgw76fnj2k", "content": "\ud83d\udfe0 CVE-2026-10055 - High (8.5)\n\nIn Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attac...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-10055/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-03T21:00:54.065997Z"}, {"uuid": "6d1433a5-93bb-40ef-88d2-061d4bb52041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10055", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mprsilk3ai2m", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-10055 \u0432 Eclipse Theia: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/FE5E6AEB-0297-4879-99FE-002B99307732", "creation_timestamp": "2026-07-04T00:28:01.914759Z"}, {"uuid": "1d95b271-b741-4b00-80a7-81b38a5e3586", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100551", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117335813361210337", "content": "CVE-2026-100551: OpenClaw for iOS (>=2026.7.1, <2026.8.11) has a CRITICAL vuln in Control UI WebViews \u2014 TLS pins not enforced. Attackers can steal Gateway creds if they can redirect traffic. Patch to 2026.8.11 ASAP! https://radar.offseq.com/threat/openclaw-for-ios-versions-202671-and-2026811-do-not-enforce-saved-gateway-tls-pins-in-the-control-ui-5ff1fd58a7f58c18 #OffSeq #Vulnerability #iOS #AppSec", "creation_timestamp": "2026-09-26T06:00:26.334009Z"}, {"uuid": "def891ab-d762-4bca-abb8-ac1c0a955730", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100557", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwforef5qd27", "content": "\ud83d\udfe0 CVE-2026-100557 - High (8.3)\n\nOpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dis...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100557/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T06:45:46.378834Z"}, {"uuid": "00514c31-43f4-4720-b32b-bf0593cbd42d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100558", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwforlij4i2g", "content": "\ud83d\udfe0 CVE-2026-100558 - High (7.5)\n\nOpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway list...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100558/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T06:45:53.563483Z"}, {"uuid": "4e360733-0fad-43dc-9320-623ad0936514", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100559", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwforsiste2c", "content": "\ud83d\udfe0 CVE-2026-100559 - High (8)\n\nOpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines c...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100559/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T06:46:00.962821Z"}, {"uuid": "eb63147e-77c1-45ec-8120-1560f02937da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100551", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfpnr565w26", "content": "\ud83d\udfe0 CVE-2026-100551 - High (8.3)\n\nOpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100551/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T07:01:38.863630Z"}, {"uuid": "8c0196b5-476b-4db5-abd6-075202bd4fcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100552", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfqh44sm325", "content": "\ud83d\udfe0 CVE-2026-100552 - High (8.8)\n\nOpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool polici...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100552/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T07:15:49.808947Z"}, {"uuid": "bcbbb307-5917-48c9-93a1-3edb055870b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100552", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh4biz6ig2y", "content": "CVE-2026-100552 - openclaw\nThe OpenClaw npm package released before version 2026.8.1 fails to keep low\u2011trust chat sessions from accessing the underlying command\u2011line and file tools. This means a user could bypass\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T20:20:05.366321Z"}, {"uuid": "58568176-1c81-437d-932e-9042014103c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100559", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh4tefh7v2r", "content": "CVE-2026-100559 - openclaw\nVersions of OpenClaw released before 2026.8.1 can be tricked into running commands that were not meant to be allowed. By using specially crafted input that includes escaped line breaks, an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T20:30:04.799655Z"}, {"uuid": "463e22c0-27a6-4458-9799-543ab1bb196f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100551", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh7mqrqz324", "content": "CVE-2026-100551 - openclaw\nVersions of OpenClaw for iOS released between July 2026 and August 2026 do not check the saved security certificate when showing the Control UI, allowing a fake page to be shown if an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T21:20:04.018138Z"}]}