{"metadata": {"vulnerability": "CVE-2026-111444", "count": 16, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-16T03:31:29.676Z", "date_only": false, "value": "2026-10-16T03:31:29.676Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111444", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T03:31:30.485Z", "date_only": false, "value": "2026-10-16T03:31:30.485Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111444", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T03:31:30.485Z", "date_only": false, "value": "2026-10-16T03:31:30.485Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2026-111444", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T03:38:03.035Z", "date_only": false, "value": "2026-10-16T03:38:03.035784Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448499686510233", "record": "CVE-2026-111444", "field": "creation_timestamp", "uuid": "361e4f41-c349-4317-8180-1dd4fc6284be", "content": "CVE-2026-111444  Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111444https://github.com/wheels-dev/wheels/security/advisories/GHSA-mvr9-2h5x-w6cq#Wheels#CVE_2026_111444#bot", "url": "https://infosec.exchange/users/cve/statuses/117448499686510233"}, {"timestamp": "2026-10-16T04:00:05.099Z", "date_only": false, "value": "2026-10-16T04:00:05.099153Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxotjn2mu2l", "record": "CVE-2026-111444", "field": "creation_timestamp", "uuid": "768c2db0-bd20-4c4d-a2f7-93af7dcf6130", "content": "CVE-2026-111444 - wheels\nThe Wheels library version 4.1.2 can be tricked into building database queries that include untrusted user data, allowing a malicious user to change the intended SQL command on MySQL or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wheels #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxotjn2mu2l"}, {"timestamp": "2026-10-16T04:18:30Z", "date_only": false, "value": "2026-10-16T04:18:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CPJX-54PQ-8RCV", "record": "GHSA-CPJX-54PQ-8RCV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T04:18:30.353Z", "date_only": false, "value": "2026-10-16T04:18:30.353", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111444", "record": "FKIE_CVE-2026-111444", "field": "published"}, {"timestamp": "2026-10-16T06:07:08.155Z", "date_only": false, "value": "2026-10-16T06:07:08.155240Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxvwpfx4k2x", "record": "CVE-2026-111444", "field": "creation_timestamp", "uuid": "03884031-7aa7-465e-a234-31b558ad6062", "content": "\ud83d\udea8 CVE-2026-111444 \u2014 CVSS 9.8 CRITICAL\n\nWheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ES...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111444\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxvwpfx4k2x"}, {"timestamp": "2026-10-16T06:30:24Z", "date_only": false, "value": "2026-10-16T06:30:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CPJX-54PQ-8RCV", "record": "GHSA-CPJX-54PQ-8RCV", "field": "published"}, {"timestamp": "2026-10-16T06:30:24Z", "date_only": false, "value": "2026-10-16T06:30:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CPJX-54PQ-8RCV", "record": "GHSA-CPJX-54PQ-8RCV", "field": "modified"}, {"timestamp": "2026-10-16T12:32:05.706Z", "date_only": false, "value": "2026-10-16T12:32:05.706516Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111444", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T12:32:05.706Z", "date_only": false, "value": "2026-10-16T12:32:05.706516Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111444", "record": "FKIE_CVE-2026-111444", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T12:32:27.499Z", "date_only": false, "value": "2026-10-16T12:32:27.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111444", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T12:32:27.499Z", "date_only": false, "value": "2026-10-16T12:32:27.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111444", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T13:58:29.076Z", "date_only": false, "value": "2026-10-16T13:58:29.076503Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxyqbkbwh62j", "record": "CVE-2026-111444", "field": "creation_timestamp", "uuid": "c4867847-6b6e-45b8-aa87-86f8841a9f1c", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-111444: Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application s\u2026\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-111444\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mxyqbkbwh62j"}, {"timestamp": "2026-10-16T15:19:36.177Z", "date_only": false, "value": "2026-10-16T15:19:36.177", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111444", "record": "FKIE_CVE-2026-111444", "field": "lastModified"}]}