{"metadata": {"vulnerability": "CVE-2026-109423", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-29T00:00:00Z", "date_only": false, "value": "2026-09-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109423", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T15:52:36.681Z", "date_only": false, "value": "2026-10-12T15:52:36.681Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109423", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T19:34:31.770Z", "date_only": false, "value": "2026-10-12T19:34:31.770Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109423", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T19:34:31.770Z", "date_only": false, "value": "2026-10-12T19:34:31.770Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109423", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T19:45:57.135Z", "date_only": false, "value": "2026-10-12T19:45:57.135126Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429656399641994", "record": "CVE-2026-109423", "field": "creation_timestamp", "uuid": "30d8ae7f-8499-433c-9e50-ea5157625a11", "content": "CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109423https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9fhttps://hr.163.com/product.html/musichttps://www.vulncheck.com/advisories/netease-cloud-music-tls-certificate-validation-bypass#NetEase #NetEaseCloudMusicforWindows#CVE_2026_109423#bot", "url": "https://infosec.exchange/users/cve/statuses/117429656399641994"}, {"timestamp": "2026-10-12T20:17:08Z", "date_only": false, "value": "2026-10-12T20:17:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MG5W-3RQQ-96M8", "record": "GHSA-MG5W-3RQQ-96M8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T20:17:08.993Z", "date_only": false, "value": "2026-10-12T20:17:08.993", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109423", "record": "FKIE_CVE-2026-109423", "field": "published"}, {"timestamp": "2026-10-12T20:50:05.287Z", "date_only": false, "value": "2026-10-12T20:50:05.287051Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpffurzya2l", "record": "CVE-2026-109423", "field": "creation_timestamp", "uuid": "68865a7f-e136-4081-97d5-a494f05e35ba", "content": "CVE-2026-109423 - netease cloud music for windows\nThe NetEase Cloud Music application for Windows (versions 3.1.38 and 3.1.39.205426) does not properly check the security certificates of the sites it connects to.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#netease #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpffurzya2l"}, {"timestamp": "2026-10-12T21:31:56Z", "date_only": false, "value": "2026-10-12T21:31:56Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MG5W-3RQQ-96M8", "record": "GHSA-MG5W-3RQQ-96M8", "field": "published"}, {"timestamp": "2026-10-12T21:31:56Z", "date_only": false, "value": "2026-10-12T21:31:56Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MG5W-3RQQ-96M8", "record": "GHSA-MG5W-3RQQ-96M8", "field": "modified"}, {"timestamp": "2026-10-12T22:08:41.046Z", "date_only": false, "value": "2026-10-12T22:08:41.046467Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpjsg36je2z", "record": "CVE-2026-109423", "field": "creation_timestamp", "uuid": "96da267b-cc47-491a-a0ed-fcb7d8f8268a", "content": "\ud83d\udea8 CVE-2026-109423 \u2014 CVSS 9.1 CRITICAL\n\nNetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS ce...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-109423\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpjsg36je2z"}, {"timestamp": "2026-10-15T13:42:15.751Z", "date_only": false, "value": "2026-10-15T13:42:15.751056Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109423", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T13:42:15.751Z", "date_only": false, "value": "2026-10-15T13:42:15.751056Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109423", "record": "FKIE_CVE-2026-109423", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T13:42:28.896Z", "date_only": false, "value": "2026-10-15T13:42:28.896Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109423", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T13:42:28.896Z", "date_only": false, "value": "2026-10-15T13:42:28.896Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109423", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:25:45.343Z", "date_only": false, "value": "2026-10-16T18:25:45.343", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109423", "record": "FKIE_CVE-2026-109423", "field": "lastModified"}]}