{"metadata": {"vulnerability": "CVE-2026-110770", "count": 15, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110770", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T17:27:35.255Z", "date_only": false, "value": "2026-10-14T17:27:35.255Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110770", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T18:47:54.543Z", "date_only": false, "value": "2026-10-14T18:47:54.543Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110770", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:47:54.543Z", "date_only": false, "value": "2026-10-14T18:47:54.543Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110770", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:47:54.543Z", "date_only": false, "value": "2026-10-14T18:47:54.543Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110770", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:13Z", "date_only": false, "value": "2026-10-14T19:17:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JJ5W-98P7-G6GJ", "record": "GHSA-JJ5W-98P7-G6GJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T19:17:13.077Z", "date_only": false, "value": "2026-10-14T19:17:13.077", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110770", "record": "FKIE_CVE-2026-110770", "field": "published"}, {"timestamp": "2026-10-14T20:12:06.531Z", "date_only": false, "value": "2026-10-14T20:12:06.531303Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxue7serg72q", "record": "CVE-2026-110770", "field": "creation_timestamp", "uuid": "d5b881b4-20dc-4dbc-8ae0-9a9d85ee8bfd", "content": "\ud83d\udea8 CVE-2026-110770 \u2014 CVSS 9.2 CRITICAL\n\nDatabasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110770\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxue7serg72q"}, {"timestamp": "2026-10-14T20:40:05.577Z", "date_only": false, "value": "2026-10-14T20:40:05.577519Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxufru2hei2r", "record": "CVE-2026-110770", "field": "creation_timestamp", "uuid": "880a27da-23e7-4bf8-9c2f-c8a9d0a196e7", "content": "CVE-2026-110770 - databasus\nVersions 3.7.0 through 3.61.0 of Databasus let anyone request a password\u2011reset code for a known email and then guess the six\u2011digit code without any limits. This can let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#databasus #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxufru2hei2r"}, {"timestamp": "2026-10-14T21:33:44Z", "date_only": false, "value": "2026-10-14T21:33:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JJ5W-98P7-G6GJ", "record": "GHSA-JJ5W-98P7-G6GJ", "field": "published"}, {"timestamp": "2026-10-14T21:33:44Z", "date_only": false, "value": "2026-10-14T21:33:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JJ5W-98P7-G6GJ", "record": "GHSA-JJ5W-98P7-G6GJ", "field": "modified"}, {"timestamp": "2026-10-14T23:58:00.370Z", "date_only": false, "value": "2026-10-14T23:58:00.370677Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441972130852932", "record": "CVE-2026-110770", "field": "creation_timestamp", "uuid": "c839e263-5dbb-4f19-b360-ab3f41afddcb", "content": "CVE-2026-110770 Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110770https://hackmd.io/@hieuPenguinnn/databasus-password-reset-code-brute-forcehttps://github.com/databasus/databasus/blob/9ee25ed8f47b1b537468417e1bb52ed2d76218a0/backend/internal/features/users/services/user_services.go#L637https://github.com/databasus/databasushttps://www.vulncheck.com/advisories/databasus-3.7.0-through-3.61.0-account-takeover-via-password-reset-brute-force#databasus#CVE_2026_110770#bot", "url": "https://infosec.exchange/users/cve/statuses/117441972130852932"}, {"timestamp": "2026-10-15T03:00:33.332Z", "date_only": false, "value": "2026-10-15T03:00:33.332286Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117442689931527187", "record": "CVE-2026-110770", "field": "creation_timestamp", "uuid": "07b84db2-2773-44c9-ac9d-bbf93edc9110", "content": "CVE-2026-110770: Databasus 3.7.0 \u2013 3.61.0 has a CRITICAL auth bypass flaw \u2014 unauthenticated attackers can brute-force password reset codes via /api/v1/users/reset-password. Patch unconfirmed \u2014 apply external mitigations. https://radar.offseq.com/threat/databasus-370-through-3610-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-6e4063880853e9f3 #OffSeq #CVE2026110770 #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117442689931527187"}, {"timestamp": "2026-10-15T03:00:35.413Z", "date_only": false, "value": "2026-10-15T03:00:35.413493Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxv327l7gy23", "record": "CVE-2026-110770", "field": "creation_timestamp", "uuid": "4a8b7a71-d444-441d-b93b-8d503feb3c61", "content": "Databasus 3.7.0 \u2013 3.61.0 affected by CRITICAL auth bypass (CVE-2026-110770). Unauthenticated attackers can brute-force password reset codes. Patch status unconfirmed \u2014 monitor and use mitigations. https://radar.offseq.com/threat/databasus-370-through-3610-contains-an-authentication-bypass-vulnera...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxv327l7gy23"}, {"timestamp": "2026-10-15T14:47:05.720Z", "date_only": false, "value": "2026-10-15T14:47:05.720", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110770", "record": "FKIE_CVE-2026-110770", "field": "lastModified"}]}