{"metadata": {"vulnerability": "CVE-2026-112136", "count": 15, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 7}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-19T04:39:55.733Z", "date_only": false, "value": "2026-10-19T04:39:55.733Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112136", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T11:30:41.077Z", "date_only": false, "value": "2026-11-10T11:30:41.077Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112136", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T11:30:41.077Z", "date_only": false, "value": "2026-11-10T11:30:41.077Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112136", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T11:30:41.077Z", "date_only": false, "value": "2026-11-10T11:30:41.077Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / siemens", "record": "CVE-2026-112136", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T11:40:38.914Z", "date_only": false, "value": "2026-11-10T11:40:38.914902Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117591955111727676", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "827e343c-0783-4fce-8a86-6858901dc670", "content": "CVE-2026-112136  A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112136https://cert-portal.siemens.com/productcert/html/ssa-710379.html#Siemens #MendixStudioPro11 #MendixStudioPro11.12#CVE_2026_112136#bot", "url": "https://infosec.exchange/users/cve/statuses/117591955111727676"}, {"timestamp": "2026-11-10T12:17:16Z", "date_only": false, "value": "2026-11-10T12:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6M57-VRCV-V9J4", "record": "GHSA-6M57-VRCV-V9J4", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T12:17:16.540Z", "date_only": false, "value": "2026-11-10T12:17:16.540", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112136", "record": "FKIE_CVE-2026-112136", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T12:17:16.540Z", "date_only": false, "value": "2026-11-10T12:17:16.540", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112136", "record": "FKIE_CVE-2026-112136", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T12:31:49Z", "date_only": false, "value": "2026-11-10T12:31:49Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6M57-VRCV-V9J4", "record": "GHSA-6M57-VRCV-V9J4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T12:31:49Z", "date_only": false, "value": "2026-11-10T12:31:49Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6M57-VRCV-V9J4", "record": "GHSA-6M57-VRCV-V9J4", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T12:50:03.375Z", "date_only": false, "value": "2026-11-10T12:50:03.375044Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzxi47hzzq2n", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "f83d5b39-4755-43de-91e0-881444f760a9", "content": "CVE-2026-112136\nCertain versions of Mendix Studio Pro do not limit the MCP Server\u2019s web listener to the local computer. As a result, anyone on the same network could connect to the server and interact with it. Update to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzxi47hzzq2n"}, {"timestamp": "2026-11-10T14:07:14.734Z", "date_only": false, "value": "2026-11-10T14:07:14.734725Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzxmgaf46t2m", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "8d89781d-ae77-4d04-a746-93532d5b7d29", "content": "\ud83d\udea8 CVE-2026-112136 \u2014 CVSS 9.2 CRITICAL\n\nA vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix S...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-112136\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzxmgaf46t2m"}], "metrics": {"as_of": "2026-11-10T15:56:20.184Z", "anchors": {"origin": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 57380.184122, "hours": 15.938940033888889, "days": 0.664122501412037, "min_seconds": 0.0, "max_seconds": 57380.184122, "approximate": true, "ongoing": true, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-10T15:56:20.184Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}