{"metadata": {"vulnerability": "CVE-2026-119757", "count": 24, "kinds": {"milestone": 4, "sighting": 9, "kev": 5, "other": 6}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-06T00:00:00Z", "date_only": false, "value": "2026-08-06T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119757", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T15:31:52.080Z", "date_only": false, "value": "2026-10-30T15:31:52.080Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119757", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T21:44:41.727Z", "date_only": false, "value": "2026-11-05T21:44:41.727Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119757", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T21:44:41.727Z", "date_only": false, "value": "2026-11-05T21:44:41.727Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119757", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T21:44:41.727Z", "date_only": false, "value": "2026-11-05T21:44:41.727Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119757", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T21:54:01.740Z", "date_only": false, "value": "2026-11-05T21:54:01.740456Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117566055445744492", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "7bac8c17-65ec-4a2a-8e1c-e7b6586e1b7d", "content": "CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119757https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/https://www.binance.com/en/square/post/384812445203404https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure#BTCPayServer#CVE_2026_119757#bot", "url": "https://infosec.exchange/users/cve/statuses/117566055445744492"}, {"timestamp": "2026-11-05T22:01:07Z", "date_only": false, "value": "2026-11-05T22:01:07+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-119757", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-05T22:01:07Z", "date_only": false, "value": "2026-11-05T22:01:07+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-119757", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-05T22:01:07Z", "date_only": false, "value": "2026-11-05T22:01:07+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-119757", "field": "status.status_updated_at", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-05T22:01:07.170Z", "date_only": false, "value": "2026-11-05T22:01:07.170Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-119757", "field": "evidence.0.details.added_date", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-05T22:17:53Z", "date_only": false, "value": "2026-11-05T22:17:53Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-87GV-MPGP-XPP2", "record": "GHSA-87GV-MPGP-XPP2", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-05T22:17:53.203Z", "date_only": false, "value": "2026-11-05T22:17:53.203", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119757", "record": "FKIE_CVE-2026-119757", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T22:50:03.225Z", "date_only": false, "value": "2026-11-05T22:50:03.225344Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlxcidlck2f", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "d1a1fd01-b37c-4271-b7cd-4594e83281f3", "content": "CVE-2026-119757 - btcpay server\nBTCPay Server versions before 2.4.2 can expose the credential files used by a Lightning Network node. An attacker who obtains these files can control the node and move its funds.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#btcpayserver #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlxcidlck2f"}, {"timestamp": "2026-11-06T00:08:16.723Z", "date_only": false, "value": "2026-11-06T00:08:16.723752Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzm3oektm222", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "af0e8ff7-aaa5-4e8c-9320-473df562cc03", "content": "\ud83d\udea8 CVE-2026-119757 \u2014 CVSS 9.3 CRITICAL\n\nBTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerab...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-119757\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzm3oektm222"}, {"timestamp": "2026-11-06T00:32:47Z", "date_only": false, "value": "2026-11-06T00:32:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-87GV-MPGP-XPP2", "record": "GHSA-87GV-MPGP-XPP2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T00:32:47Z", "date_only": false, "value": "2026-11-06T00:32:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-87GV-MPGP-XPP2", "record": "GHSA-87GV-MPGP-XPP2", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T01:30:35.625Z", "date_only": false, "value": "2026-11-06T01:30:35.625487Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117566907021674883", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "4cd96e70-4b9d-453c-83d5-1d924806d1c2", "content": "BTCPay Server <2.4.2 has a CRITICAL info disclosure (CVE-2026-119757, CVSS 9.8) \u2013 unauthenticated attackers can grab LND .macaroon credentials, gaining full node control & fund access. Restrict access, secure creds! https://radar.offseq.com/threat/btcpay-server-before-242-including-242-release-candidates-contains-an-information-disclosure-fad28409be2be3bd #OffSeq #Vuln #BTCpay", "url": "https://infosec.exchange/users/offseq/statuses/117566907021674883"}, {"timestamp": "2026-11-06T01:30:37.708Z", "date_only": false, "value": "2026-11-06T01:30:37.708146Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mzmablzlf52w", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "7d9cf84b-7bc0-4368-aa4a-3a64f8773898", "content": "BTCPay Server <2.4.2 info leak (CVE-2026-119757, CRITICAL): Remote attackers can steal LND .macaroon credentials & move funds. Restrict access, secure credentials. https://radar.offseq.com/threat/btcpay-server-before-242-including-242-release-candidates-contains-an-information-disclosure-fad28409...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mzmablzlf52w"}, {"timestamp": "2026-11-06T04:31:43.952Z", "date_only": false, "value": "2026-11-06T04:31:43.952020Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzmkfggyxk2t", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "ad1a8298-be3d-45dd-a819-e9842ce0e93b", "content": "\ud83d\udd34 CVE-2026-119757 - Critical (9.8)\n\nBTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosur...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-119757/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzmkfggyxk2t"}, {"timestamp": "2026-11-06T23:00:01Z", "date_only": false, "value": "2026-11-06T23:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-119757", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-06T23:00:33.693Z", "date_only": false, "value": "2026-11-06T23:00:33.693765Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "0597aa31-b26e-4990-8880-791e2d97c490", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-07T16:13:45.019Z", "date_only": false, "value": "2026-11-07T16:13:45.019513Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzqc3of6j72y", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "5ec9900e-5619-41c7-b3ee-8f0d67bca6db", "content": "New critical vulnerability in BTCPay Server: CVE-2026-119757, CVSS 9.3. BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that\u2026 No public exploit reported yet. #CVE #vulnerability\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzqc3of6j72y"}, {"timestamp": "2026-11-07T16:53:39.079Z", "date_only": false, "value": "2026-11-07T16:53:39.079540Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mzqeczslye2q", "record": "CVE-2026-119757", "field": "creation_timestamp", "uuid": "9fbfde74-96d0-4923-88f7-58c77697f707", "content": "CVE-2026-119757 is trending. Hype score 13, currently #3 on cvemon.\n\nBTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-119757", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mzqeczslye2q"}, {"timestamp": "2026-11-12T21:30:23.870Z", "date_only": false, "value": "2026-11-12T21:30:23.870", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119757", "record": "FKIE_CVE-2026-119757", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T03:09:17.238Z", "anchors": {"origin": {"timestamp": "2026-08-06T00:00:00Z", "date_only": false, "value": "2026-08-06T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119757", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-06T00:00:00Z", "date_only": false, "value": "2026-08-06T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119757", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": {"timestamp": "2026-11-05T22:01:07Z", "date_only": false, "value": "2026-11-05T22:01:07+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-119757", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 7941667.0, "hours": 2206.018611111111, "days": 91.91744212962963, "min_seconds": 7855267.0, "max_seconds": 7941667.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-06T00:00:00Z", "date_only": false, "value": "2026-08-06T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119757", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T22:01:07Z", "date_only": false, "value": "2026-11-05T22:01:07+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-119757", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 7941667.0, "hours": 2206.018611111111, "days": 91.91744212962963, "min_seconds": 7855267.0, "max_seconds": 7941667.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-06T00:00:00Z", "date_only": false, "value": "2026-08-06T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119757", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T22:01:07Z", "date_only": false, "value": "2026-11-05T22:01:07+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-119757", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 8564957.238299, "hours": 2379.154788416389, "days": 99.13144951734952, "min_seconds": 8478557.238299, "max_seconds": 8564957.238299, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-06T00:00:00Z", "date_only": false, "value": "2026-08-06T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119757", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T03:09:17.238Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 623290.238299, "hours": 173.13617730527776, "days": 7.214007387719907, "min_seconds": 623290.238299, "max_seconds": 623290.238299, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T22:01:07Z", "date_only": false, "value": "2026-11-05T22:01:07+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-119757", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3e27d0f1-7be6-4cc0-8604-f2aac4503c84", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-13T03:09:17.238Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}