{"metadata": {"vulnerability": "CVE-2026-111663", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111663", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-16T14:31:16.640Z", "date_only": false, "value": "2026-10-16T14:31:16.640Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111663", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:39:26.910Z", "date_only": false, "value": "2026-10-16T17:39:26.910Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111663", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-16T17:39:26.910Z", "date_only": false, "value": "2026-10-16T17:39:26.910Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111663", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:48Z", "date_only": false, "value": "2026-10-16T18:17:48Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RGGR-4J68-HC5W", "record": "GHSA-RGGR-4J68-HC5W", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-16T18:17:48.077Z", "date_only": false, "value": "2026-10-16T18:17:48.077", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111663", "record": "FKIE_CVE-2026-111663", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-16T18:28:49.199Z", "date_only": false, "value": "2026-10-16T18:28:49.199034Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452002336890954", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "72561694-9e95-47e0-9083-ab1917bf2905", "content": "CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111663https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-uploadhttps://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb#L29-L66https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/graphql_controller.rb#L3-L33https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-ssrf-via-createurlupload-graphql-mutation#chaskiq#CVE_2026_111663#bot", "url": "https://infosec.exchange/users/cve/statuses/117452002336890954"}, {"timestamp": "2026-10-16T18:34:48Z", "date_only": false, "value": "2026-10-16T18:34:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RGGR-4J68-HC5W", "record": "GHSA-RGGR-4J68-HC5W", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-16T18:34:48Z", "date_only": false, "value": "2026-10-16T18:34:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RGGR-4J68-HC5W", "record": "GHSA-RGGR-4J68-HC5W", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-16T20:08:52.939Z", "date_only": false, "value": "2026-10-16T20:08:52.939342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzexuyzqy2w", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "119f3fb4-3bb9-40e8-b876-d26abe4331fb", "content": "\ud83d\udea8 CVE-2026-111663 \u2014 CVSS 9.2 CRITICAL\n\nChaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated atta...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111663\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzexuyzqy2w"}, {"timestamp": "2026-10-16T20:40:06.604Z", "date_only": false, "value": "2026-10-16T20:40:06.604229Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzgpplfeh2n", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "50b8db53-cf68-4cec-9f48-1548bbce7439", "content": "CVE-2026-111663 - chaskiq\nThe Chaskiq service (up to version 2.0.3) lets anyone send a special request that makes the server fetch any web address, even hidden internal ones like cloud metadata pages. The server then\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#chaskiq #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzgpplfeh2n"}, {"timestamp": "2026-10-17T09:00:26.717Z", "date_only": false, "value": "2026-10-17T09:00:26.717358Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117455429686216788", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "8cf87c17-83a4-4612-8fa8-4e782b877c51", "content": "CRITICAL SSRF in Chaskiq <=2.0.3 (CVE-2026-111663): Unauthenticated attackers can fetch internal/cloud URLs via GraphQL, risking sensitive data exposure. Restrict /graphql access & monitor POSTs. CVSS 8.6. https://radar.offseq.com/threat/chaskiq-through-203-contains-a-server-side-request-forgery-vulnerability-that-allows-unauthenticated-cc1602d36198eead #OffSeq #SSRF #Chaskiq #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/117455429686216788"}, {"timestamp": "2026-10-23T15:56:09.927Z", "date_only": false, "value": "2026-10-23T15:56:09.927767Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111663", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-23T15:56:09.927Z", "date_only": false, "value": "2026-10-23T15:56:09.927767Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111663", "record": "FKIE_CVE-2026-111663", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-23T15:56:17.575Z", "date_only": false, "value": "2026-10-23T15:56:17.575Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111663", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T15:56:17.575Z", "date_only": false, "value": "2026-10-23T15:56:17.575Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111663", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T16:16:51.090Z", "date_only": false, "value": "2026-10-23T16:16:51.090", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111663", "record": "FKIE_CVE-2026-111663", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T16:53:41.471Z", "anchors": {"origin": {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111663", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111663", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2393621.471522, "hours": 664.8948532005556, "days": 27.703952216689817, "min_seconds": 2307221.471522, "max_seconds": 2393621.471522, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111663", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T16:53:41.471Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}