{"metadata": {"vulnerability": "CVE-2026-111687", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111687", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T14:31:19.910Z", "date_only": false, "value": "2026-10-16T14:31:19.910Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111687", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:39:44.866Z", "date_only": false, "value": "2026-10-16T17:39:44.866Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111687", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T17:39:44.866Z", "date_only": false, "value": "2026-10-16T17:39:44.866Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111687", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:51Z", "date_only": false, "value": "2026-10-16T18:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HP95-P2WW-6RVC", "record": "GHSA-HP95-P2WW-6RVC", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T18:17:51.920Z", "date_only": false, "value": "2026-10-16T18:17:51.920", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111687", "record": "FKIE_CVE-2026-111687", "field": "published"}, {"timestamp": "2026-10-16T18:34:51Z", "date_only": false, "value": "2026-10-16T18:34:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HP95-P2WW-6RVC", "record": "GHSA-HP95-P2WW-6RVC", "field": "published"}, {"timestamp": "2026-10-16T18:34:51Z", "date_only": false, "value": "2026-10-16T18:34:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HP95-P2WW-6RVC", "record": "GHSA-HP95-P2WW-6RVC", "field": "modified"}, {"timestamp": "2026-10-16T18:44:58.211Z", "date_only": false, "value": "2026-10-16T18:44:58.211710Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452065836061082", "record": "CVE-2026-111687", "field": "creation_timestamp", "uuid": "9e920bbc-9987-4b38-a653-ea05bc5d887d", "content": "CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111687https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rcehttps://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint#rachelos #we-mp-rss#CVE_2026_111687#bot", "url": "https://infosec.exchange/users/cve/statuses/117452065836061082"}, {"timestamp": "2026-10-16T19:04:57.256Z", "date_only": false, "value": "2026-10-16T19:04:57.256748Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111687", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T19:04:57.256Z", "date_only": false, "value": "2026-10-16T19:04:57.256748Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111687", "record": "FKIE_CVE-2026-111687", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T19:05:43.558Z", "date_only": false, "value": "2026-10-16T19:05:43.558Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111687", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:05:43.558Z", "date_only": false, "value": "2026-10-16T19:05:43.558Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111687", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:59:50.623Z", "date_only": false, "value": "2026-10-16T19:59:50.623056Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxzehpst6y2l", "record": "CVE-2026-111687", "field": "creation_timestamp", "uuid": "e7e8fd0d-9d2e-42fb-9960-19ed316c62be", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-111687: WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-111687\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mxzehpst6y2l"}, {"timestamp": "2026-10-16T20:09:18.816Z", "date_only": false, "value": "2026-10-16T20:09:18.816283Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzeyn7l7o2x", "record": "CVE-2026-111687", "field": "creation_timestamp", "uuid": "7103f0f7-9555-4b3d-8b40-8d9a67b3b126", "content": "\ud83d\udea8 CVE-2026-111687 \u2014 CVSS 9.3 CRITICAL\n\nWeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111687\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzeyn7l7o2x"}, {"timestamp": "2026-10-16T20:17:22.260Z", "date_only": false, "value": "2026-10-16T20:17:22.260", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111687", "record": "FKIE_CVE-2026-111687", "field": "lastModified"}, {"timestamp": "2026-10-16T20:20:04.598Z", "date_only": false, "value": "2026-10-16T20:20:04.598837Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzflv3xpe2q", "record": "CVE-2026-111687", "field": "creation_timestamp", "uuid": "8c61b5cc-3354-4377-a15a-a6a015009954", "content": "CVE-2026-111687 - we-mp-rss\nThe WeRSS application (versions up to 1.5.3) lets anyone on the internet send specially crafted requests to its public RSS endpoint and cause the server to execute commands. This can give\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rachelos #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzflv3xpe2q"}]}