{"metadata": {"vulnerability": "CVE-2026-112197", "count": 13, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-19T09:39:01.039Z", "date_only": false, "value": "2026-10-19T09:39:01.039Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112197", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T10:15:00Z", "date_only": false, "value": "2026-10-28T10:15:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-112197", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:17:12.401Z", "date_only": false, "value": "2026-10-28T10:17:12.401Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112197", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:17:12.401Z", "date_only": false, "value": "2026-10-28T10:17:12.401Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112197", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T10:17:12.401Z", "date_only": false, "value": "2026-10-28T10:17:12.401Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-112197", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T10:33:00.996Z", "date_only": false, "value": "2026-10-28T10:33:00.996690Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518079131138729", "record": "CVE-2026-112197", "field": "creation_timestamp", "uuid": "8b506425-1df2-404e-a3e0-7e1098875c5a", "content": "CVE-2026-112197 Missing Authentication for Critical Function in Tactis' NoviGest Desktop App Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112197https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app#Tactis #NoviGestDesktopApp#CVE_2026_112197#bot", "url": "https://infosec.exchange/users/cve/statuses/117518079131138729"}, {"timestamp": "2026-10-28T11:17:15Z", "date_only": false, "value": "2026-10-28T11:17:15Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HMPJ-9P3Q-VVC4", "record": "GHSA-HMPJ-9P3Q-VVC4", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-28T11:17:15.073Z", "date_only": false, "value": "2026-10-28T11:17:15.073", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112197", "record": "FKIE_CVE-2026-112197", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T12:08:09.983Z", "date_only": false, "value": "2026-10-28T12:08:09.983729Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mywppdrhvo2w", "record": "CVE-2026-112197", "field": "creation_timestamp", "uuid": "229048c5-33b7-4eeb-a219-c81dfb32cc96", "content": "\ud83d\udea8 CVE-2026-112197 \u2014 CVSS 9.4 CRITICAL\n\nVulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-112197\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mywppdrhvo2w"}, {"timestamp": "2026-10-28T12:30:36Z", "date_only": false, "value": "2026-10-28T12:30:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HMPJ-9P3Q-VVC4", "record": "GHSA-HMPJ-9P3Q-VVC4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T12:30:36Z", "date_only": false, "value": "2026-10-28T12:30:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HMPJ-9P3Q-VVC4", "record": "GHSA-HMPJ-9P3Q-VVC4", "field": "modified"}, {"timestamp": "2026-10-28T14:43:13.110Z", "date_only": false, "value": "2026-10-28T14:43:13.110", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112197", "record": "FKIE_CVE-2026-112197", "field": "lastModified"}, {"timestamp": "2026-10-28T16:00:05.888Z", "date_only": false, "value": "2026-10-28T16:00:05.888024Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myx4o2tcus22", "record": "CVE-2026-112197", "field": "creation_timestamp", "uuid": "11f85127-b061-4832-8b99-91cd9e567cde", "content": "CVE-2026-112197 - novigest desktop app\nThe NoviGest Desktop application accepts remote requests without checking who is sending them. Someone on the same network could use this to read passwords, run database queries\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#tactis #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myx4o2tcus22"}], "metrics": {"as_of": "2026-11-02T16:31:36.986Z", "anchors": {"origin": {"timestamp": "2026-10-28T10:15:00Z", "date_only": false, "value": "2026-10-28T10:15:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-112197", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T10:15:00Z", "date_only": false, "value": "2026-10-28T10:15:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-112197", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 454596.986284, "hours": 126.27694063444444, "days": 5.261539193101852, "min_seconds": 454596.986284, "max_seconds": 454596.986284, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T10:15:00Z", "date_only": false, "value": "2026-10-28T10:15:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-112197", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T16:31:36.986Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}