{"metadata": {"vulnerability": "CVE-2026-118976", "count": 9, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 4}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-29T09:13:28.520Z", "date_only": false, "value": "2026-10-29T09:13:28.520Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-118976", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T14:33:21.126Z", "date_only": false, "value": "2026-11-13T14:33:21.126Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-118976", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T14:33:21.126Z", "date_only": false, "value": "2026-11-13T14:33:21.126Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-118976", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T14:33:21.126Z", "date_only": false, "value": "2026-11-13T14:33:21.126Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ProgressSoftware", "record": "CVE-2026-118976", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T14:41:21.179Z", "date_only": false, "value": "2026-11-13T14:41:21.179049Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117609652596638045", "record": "cve-2026-118976", "field": "creation_timestamp", "uuid": "445150d5-ec68-43aa-bda0-1da3d627fdf1", "content": "CVE-2026-118976 Path Traversal in Telerik UI for Blazor Demo's Chat AI Integration Example In Progress\u00ae Telerik\u00ae UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.\nhttps://www.cve.org/CVERecord?id=CVE-2026-118976https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-demo-path-traversal-cve-2026-118976#telerik #ProgressSoftware #TelerikUIforBlazor#CVE_2026_118976#bot", "url": "https://infosec.exchange/users/cve/statuses/117609652596638045"}, {"timestamp": "2026-11-13T14:42:01.656Z", "date_only": false, "value": "2026-11-13T14:42:01.656932Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117609655242316706", "record": "cve-2026-118976", "field": "creation_timestamp", "uuid": "868020e8-0da1-4bb0-a9a3-8b7d0ce79c8b", "content": "CVE-2026-119102 AI Command Filters On Any Property Bypassing Column Allowlist In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119102https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-demo-path-traversal-cve-2026-118976#telerik #ProgressSoftware #TelerikUIforBlazor#CVE_2026_119102#bot", "url": "https://infosec.exchange/users/cve/statuses/117609655242316706"}, {"timestamp": "2026-11-13T15:17:32Z", "date_only": false, "value": "2026-11-13T15:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-H2GG-9W6W-7H99", "record": "GHSA-H2GG-9W6W-7H99", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T15:31:42Z", "date_only": false, "value": "2026-11-13T15:31:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H2GG-9W6W-7H99", "record": "GHSA-H2GG-9W6W-7H99", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T15:31:42Z", "date_only": false, "value": "2026-11-13T15:31:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H2GG-9W6W-7H99", "record": "GHSA-H2GG-9W6W-7H99", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-14T03:21:25.021Z", "anchors": {"origin": {"timestamp": "2026-11-13T14:33:21.126Z", "date_only": false, "value": "2026-11-13T14:33:21.126Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-118976", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-13T14:33:21.126Z", "date_only": false, "value": "2026-11-13T14:33:21.126Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-118976", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 46083.895107, "hours": 12.801081974166665, "days": 0.5333784155902778, "min_seconds": 46083.895107, "max_seconds": 46083.895107, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-13T14:33:21.126Z", "date_only": false, "value": "2026-11-13T14:33:21.126Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-118976", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T03:21:25.021Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}