{"metadata": {"vulnerability": "CVE-2026-104142", "count": 11, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-01T18:47:30.995Z", "date_only": false, "value": "2026-10-01T18:47:30.995Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104142", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T18:42:36.214Z", "date_only": false, "value": "2026-10-14T18:42:36.214Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104142", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:42:36.214Z", "date_only": false, "value": "2026-10-14T18:42:36.214Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-104142", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:08.177Z", "date_only": false, "value": "2026-10-14T19:17:08.177", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104142", "record": "FKIE_CVE-2026-104142", "field": "published"}, {"timestamp": "2026-10-14T23:49:15.054Z", "date_only": false, "value": "2026-10-14T23:49:15.054466Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441937709191123", "record": "CVE-2026-104142", "field": "creation_timestamp", "uuid": "eaeab0b4-018f-4709-bef0-b258267b679a", "content": "CVE-2026-104142 DataEase: Stored SQL Injection in group-field binning bounds DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104142https://github.com/dataease/dataease/security/advisories/GHSA-gcr3-cj2q-gj4qhttps://github.com/dataease/dataease/commit/59191a17657b75d0721e428c10bc0065c3310b17https://github.com/dataease/dataease/releases/tag/v2.10.26#dataease#CVE_2026_104142#bot", "url": "https://infosec.exchange/users/cve/statuses/117441937709191123"}, {"timestamp": "2026-10-15T11:40:06.369Z", "date_only": false, "value": "2026-10-15T11:40:06.369879Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxvy375nsc2n", "record": "CVE-2026-104142", "field": "creation_timestamp", "uuid": "4dae370d-d3d3-4229-86eb-b5960dadbc18", "content": "CVE-2026-104142 - dataease\nDataEase versions before\u202f2.10.26 let logged\u2011in users save specially crafted values in chart settings. Those values are inserted directly into database queries, letting an attacker change\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#dataease #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxvy375nsc2n"}, {"timestamp": "2026-10-15T14:36:35.392Z", "date_only": false, "value": "2026-10-15T14:36:35.392459Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104142", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T14:36:35.392Z", "date_only": false, "value": "2026-10-15T14:36:35.392459Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104142", "record": "FKIE_CVE-2026-104142", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T14:37:10.357Z", "date_only": false, "value": "2026-10-15T14:37:10.357Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104142", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T14:37:10.357Z", "date_only": false, "value": "2026-10-15T14:37:10.357Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104142", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T15:17:20.913Z", "date_only": false, "value": "2026-10-15T15:17:20.913", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104142", "record": "FKIE_CVE-2026-104142", "field": "lastModified"}]}