{"metadata": {"vulnerability": "CVE-2026-111356", "count": 18, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111356", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-15T20:56:53.414Z", "date_only": false, "value": "2026-10-15T20:56:53.414Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111356", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T21:43:45.212Z", "date_only": false, "value": "2026-10-15T21:43:45.212Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111356", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T21:43:45.212Z", "date_only": false, "value": "2026-10-15T21:43:45.212Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111356", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T22:15:00.151Z", "date_only": false, "value": "2026-10-15T22:15:00.151506Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117447229409917423", "record": "CVE-2026-111356", "field": "creation_timestamp", "uuid": "f508512b-8f6d-4161-afbb-56b5235c14a8", "content": "CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111356https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeoverhttps://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1199-L1231https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1397-L1450https://github.com/magicblack/maccms10https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-account-takeover-via-password-recovery-brute-force#magicblack #MacCMS#CVE_2026_111356#bot", "url": "https://infosec.exchange/users/cve/statuses/117447229409917423"}, {"timestamp": "2026-10-15T22:19:33Z", "date_only": false, "value": "2026-10-15T22:19:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X2WF-9F7G-PJXV", "record": "GHSA-X2WF-9F7G-PJXV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T22:19:33.647Z", "date_only": false, "value": "2026-10-15T22:19:33.647", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111356", "record": "FKIE_CVE-2026-111356", "field": "published"}, {"timestamp": "2026-10-15T23:50:07.162Z", "date_only": false, "value": "2026-10-15T23:50:07.162016Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxauktddb2z", "record": "CVE-2026-111356", "field": "creation_timestamp", "uuid": "bca4bb6a-c10c-40b6-a41e-06c33649c38d", "content": "CVE-2026-111356 - maccms\nThe MacCMS platform allows unlimited attempts to guess the six\u2011digit code used for password recovery. An attacker who knows a user's email or phone number can request a code and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#maccms #magicblack #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxauktddb2z"}, {"timestamp": "2026-10-16T00:08:38.823Z", "date_only": false, "value": "2026-10-16T00:08:38.823993Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxbvovrex2r", "record": "CVE-2026-111356", "field": "creation_timestamp", "uuid": "9d2062e6-392e-4403-99e9-3aafca56c903", "content": "\ud83d\udea8 CVE-2026-111356 \u2014 CVSS 9.1 CRITICAL\n\nMacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111356\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxbvovrex2r"}, {"timestamp": "2026-10-16T00:31:58Z", "date_only": false, "value": "2026-10-16T00:31:58Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X2WF-9F7G-PJXV", "record": "GHSA-X2WF-9F7G-PJXV", "field": "published"}, {"timestamp": "2026-10-16T00:31:58Z", "date_only": false, "value": "2026-10-16T00:31:58Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X2WF-9F7G-PJXV", "record": "GHSA-X2WF-9F7G-PJXV", "field": "modified"}, {"timestamp": "2026-10-16T01:30:27.458Z", "date_only": false, "value": "2026-10-16T01:30:27.458203Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117447997870940604", "record": "cve-2026-111356", "field": "creation_timestamp", "uuid": "f1e0cbfd-88fc-4ffd-98c0-9b585b261544", "content": "CVE-2026-111356 (CRITICAL, CVSS 9.1) in magicblack MacCMS <=2026.1000.4056 allows unauthenticated brute-forcing of password recovery codes, risking account takeover. Rate limiting is advised until a patch is confirmed. https://radar.offseq.com/threat/cve-2026-111356-improper-restriction-of-excessive-authentication-attempts-in-magicblack-maccms-7a578a56fecd347f #OffSeq #CVE2026111356 #infosec #bruteforce", "url": "https://infosec.exchange/users/offseq/statuses/117447997870940604"}, {"timestamp": "2026-10-16T01:30:28.890Z", "date_only": false, "value": "2026-10-16T01:30:28.890809Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxxghyrbxh23", "record": "cve-2026-111356", "field": "creation_timestamp", "uuid": "e88114a4-def4-4605-ad85-a6e1c583e3d5", "content": "magicblack MacCMS <=2026.1000.4056 faces a CRITICAL vuln (CVE-2026-111356): accounts can be hijacked via brute-forced recovery codes. Apply rate limiting ASAP while awaiting a patch. https://radar.offseq.com/threat/cve-2026-111356-improper-restriction-of-excessive-authentication-attempts-in-magic...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxxghyrbxh23"}, {"timestamp": "2026-10-16T16:49:26.985Z", "date_only": false, "value": "2026-10-16T16:49:26.985761Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111356", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:49:26.985Z", "date_only": false, "value": "2026-10-16T16:49:26.985761Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111356", "record": "FKIE_CVE-2026-111356", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T16:49:52.059Z", "date_only": false, "value": "2026-10-16T16:49:52.059Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111356", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:49:52.059Z", "date_only": false, "value": "2026-10-16T16:49:52.059Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111356", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:25:45.343Z", "date_only": false, "value": "2026-10-16T18:25:45.343", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111356", "record": "FKIE_CVE-2026-111356", "field": "lastModified"}]}