{"metadata": {"vulnerability": "CVE-2026-111387", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111387", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-15T21:55:44.537Z", "date_only": false, "value": "2026-10-15T21:55:44.537Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111387", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T01:17:55.957Z", "date_only": false, "value": "2026-10-16T01:17:55.957Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111387", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T01:17:55.957Z", "date_only": false, "value": "2026-10-16T01:17:55.957Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111387", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T01:42:58.436Z", "date_only": false, "value": "2026-10-16T01:42:58.436411Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448047196576072", "record": "CVE-2026-111387", "field": "creation_timestamp", "uuid": "2f3d23a4-f1cd-4ec5-b53a-717808a57431", "content": "CVE-2026-111387 Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111387https://github.com/nezhahq/nezha/security/advisories/GHSA-hpfr-cmgc-f455https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0fhttps://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61ehttps://www.vulncheck.com/advisories/nezha-2.2.5-before-2.3.15-information-disclosure-via-ddns-list-endpoint#nezhahq #nezha#CVE_2026_111387#bot", "url": "https://infosec.exchange/users/cve/statuses/117448047196576072"}, {"timestamp": "2026-10-16T03:18:06Z", "date_only": false, "value": "2026-10-16T03:18:06Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7922-F42V-J7C8", "record": "GHSA-7922-F42V-J7C8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T03:18:06.217Z", "date_only": false, "value": "2026-10-16T03:18:06.217", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111387", "record": "FKIE_CVE-2026-111387", "field": "published"}, {"timestamp": "2026-10-16T03:30:28Z", "date_only": false, "value": "2026-10-16T03:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7922-F42V-J7C8", "record": "GHSA-7922-F42V-J7C8", "field": "published"}, {"timestamp": "2026-10-16T03:30:29Z", "date_only": false, "value": "2026-10-16T03:30:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7922-F42V-J7C8", "record": "GHSA-7922-F42V-J7C8", "field": "modified"}, {"timestamp": "2026-10-16T16:31:55.598Z", "date_only": false, "value": "2026-10-16T16:31:55.598918Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111387", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:31:55.598Z", "date_only": false, "value": "2026-10-16T16:31:55.598918Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111387", "record": "FKIE_CVE-2026-111387", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T17:07:24.986Z", "date_only": false, "value": "2026-10-16T17:07:24.986Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111387", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:07:24.986Z", "date_only": false, "value": "2026-10-16T17:07:24.986Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111387", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:38.837Z", "date_only": false, "value": "2026-10-16T18:17:38.837", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111387", "record": "FKIE_CVE-2026-111387", "field": "lastModified"}]}