{"metadata": {"vulnerability": "CVE-2026-126192", "count": 97, "kinds": {"milestone": 45, "sighting": 3, "kev": 0, "other": 49}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-10T20:07:44.957Z", "date_only": false, "value": "2026-11-10T20:07:44.957Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-126192", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T17:09:14.205Z", "date_only": false, "value": "2026-11-12T17:09:14.205Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126192", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T17:09:14.205Z", "date_only": false, "value": "2026-11-12T17:09:14.205Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-126192", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T17:17:04.898Z", "date_only": false, "value": "2026-11-12T17:17:04.898766Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117604602631807064", "record": "CVE-2026-126192", "field": "creation_timestamp", "uuid": "b2d7d9f0-3788-4cfd-9bfa-9a8e5f067988", "content": "CVE-2026-126192 Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10.\nhttps://www.cve.org/CVERecord?id=CVE-2026-126192https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4https://github.com/facelessuser/soupsieve/pull/304https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0https://github.com/facelessuser/soupsieve/releases/tag/2.10#facelessuser #soupsieve#CVE_2026_126192#bot", "url": "https://infosec.exchange/users/cve/statuses/117604602631807064"}, {"timestamp": "2026-11-12T17:17:32Z", "date_only": false, "value": "2026-11-12T17:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4J63-6C4X-WFG4", "record": "GHSA-4J63-6C4X-WFG4", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-12T17:17:32.793Z", "date_only": false, "value": "2026-11-12T17:17:32.793", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-126192", "record": "FKIE_CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-126192", "record": "UBUNTU-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-126192", "record": "UBUNTU-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T00:20:14.507Z", "date_only": false, "value": "2026-11-13T00:20:14.507190Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126192", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T00:20:14.507Z", "date_only": false, "value": "2026-11-13T00:20:14.507190Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-126192", "record": "FKIE_CVE-2026-126192", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-13T00:20:38.658Z", "date_only": false, "value": "2026-11-13T00:20:38.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-126192", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T00:20:38.658Z", "date_only": false, "value": "2026-11-13T00:20:38.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126192", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T00:45:18Z", "date_only": false, "value": "2026-11-13T00:45:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4J63-6C4X-WFG4", "record": "GHSA-4J63-6C4X-WFG4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T00:45:18Z", "date_only": false, "value": "2026-11-13T00:45:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "record": "CVE-2026-126192", "field": "creation_timestamp", "uuid": "7b1dc8f6-2c5b-497f-9410-ff8ea4c46cf6", "url": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T00:45:18Z", "date_only": false, "value": "2026-11-13T00:45:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4J63-6C4X-WFG4", "record": "GHSA-4J63-6C4X-WFG4", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T02:18:51.393Z", "date_only": false, "value": "2026-11-13T02:18:51.393", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-126192", "record": "FKIE_CVE-2026-126192", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-13T02:30:51Z", "date_only": false, "value": "2026-11-13T02:30:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/684fb9b25af9d8f5965692ef2b599cd6", "record": "CVE-2026-126192", "field": "creation_timestamp", "uuid": "9649f5ce-9819-4a4b-8db7-16789cc79a29", "content": "# CVE-2026-126192: CVE-2026-126192: Quadratic Algorithmic Complexity Denial of Service in Soup Sieve CSS Selector Engine\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-11-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-126192\n\n## Summary\nCVE-2026-126192 is an algorithmic complexity vulnerability in Soup Sieve (soupsieve), the default CSS selector engine for Beautiful Soup 4 in Python. Evaluating a CSS selector that contains a general sibling combinator (~) nested inside a :has() relational pseudo-class against attacker-controlled HTML markup triggers O(n^2) quadratic evaluation complexity when the right-hand sibling target is absent. An unauthenticated attacker can supply small HTML documents containing thousands of sibling elements to exhaust CPU resources and stall application worker threads.\n\n## TL;DR\nSoup Sieve versions prior to 2.10 exhibit O(n^2) quadratic time complexity when matching CSS selectors that combine the :has() pseudo-class with the general sibling combinator (~), such as div:has(a ~ b). Submitting a ~56 KB HTML payload containing 8,000 sibling elements without the terminating match locks a CPU core for approximately 60 seconds, enabling remote Denial of Service. Upgrading to soupsieve 2.10 resolves the issue via sibling index caching.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-126192 (GHSA-4j63-6c4x-wfg4)\n- **Affected Package**: soupsieve (PyPI) < 2.10.0\n- **Patched Version**: soupsieve 2.10.0\n- **Vulnerability Class**: CWE-407: Inefficient Algorithmic Complexity / CWE-400\n- **CVSS v4.0 Score**: 6.3 Medium (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)\n- **Attack Vector**: Network (Untrusted HTML markup evaluated against :has(a ~ b) CSS selectors)\n- **Primary Impact**: Application Denial of Service (O(n^2) CPU exhaustion)\n- **Exploit Status**: Proof of Concept (PoC) publicly available; Not in CISA KEV\n\n## Affected Systems\n\n- Python applications using soupsieve < 2.10.0\n- Python applications using Beautiful Soup 4 (bs4) with soupsieve < 2.10.0\n- **soupsieve**: < 2.10.0 (0.4 through 2.9.2) (Fixed in: `2.10.0`)\n\n## Mitigation\n\n- Upgrade the soupsieve Python package to version 2.10.0 or newer to enable sibling traversal caching.\n- Refactor application CSS selectors to replace general sibling combinators (~) inside :has() with adjacent sibling combinators (+) where functionally equivalent.\n- Use the ignore parameter introduced in soupsieve 2.10.0 to disallow the :has() pseudo-class when compiling untrusted or user-supplied CSS selectors.\n- Isolate HTML parsing and CSS selector evaluation in background worker processes with strict execution timeouts and payload size limits.\n\n**Remediation Steps:**\n1. Audit project dependencies (requirements.txt, Pipfile.lock, poetry.lock) to identify versions of soupsieve prior to 2.10.0.\n2. Run 'pip install --upgrade \"soupsieve>=2.10.0\"' across all affected Python environments and container images.\n3. Verify the installed version at runtime using 'import soupsieve; assert soupsieve.__version_info__ >= (2, 10, 0)'.\n4. Search application source code for calls to BeautifulSoup.select(), BeautifulSoup.select_one(), or soupsieve functions that utilize ':has(' combined with '~' or accept unvalidated user selector strings.\n\n## References\n\n- [GitHub Security Advisory GHSA-4j63-6c4x-wfg4](https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4)\n- [Fix Commit ffb88cca745c591224f74a8e86414a85e8f35fc0](https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0)\n- [Soup Sieve Pull Request #304](https://github.com/facelessuser/soupsieve/pull/304)\n- [Soup Sieve 2.10 Release Notes](https://github.com/facelessuser/soupsieve/releases/tag/2.10)\n- [Official CVE.org Record for CVE-2026-126192](https://www.cve.org/CVERecord?id=CVE-2026-126192)\n- [National Vulnerability Database (NVD) Record for CVE-2026-126192](https://nvd.nist.gov/vuln/detail/CVE-2026-126192)\n- [Soup Sieve Upstream Repository](https://github.com/facelessuser/soupsieve)\n- [MITRE ATT&CK Search Reference](https://attack.mitre.org/search/?search=CVE-2026-126192)\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-126192) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/684fb9b25af9d8f5965692ef2b599cd6"}, {"timestamp": "2026-11-13T08:38:55Z", "date_only": false, "value": "2026-11-13T08:38:55Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-BILIX-CVE-2026-126192", "record": "BREW-BILIX-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:38:55Z", "date_only": false, "value": "2026-11-13T08:38:55Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-BILIX-CVE-2026-126192", "record": "BREW-BILIX-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T08:40:02Z", "date_only": false, "value": "2026-11-13T08:40:02Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-BANDCAMP-DL-CVE-2026-126192", "record": "BREW-BANDCAMP-DL-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:40:02Z", "date_only": false, "value": "2026-11-13T08:40:02Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-BANDCAMP-DL-CVE-2026-126192", "record": "BREW-BANDCAMP-DL-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T08:45:51Z", "date_only": false, "value": "2026-11-13T08:45:51Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-CPPMAN-CVE-2026-126192", "record": "BREW-CPPMAN-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:45:51Z", "date_only": false, "value": "2026-11-13T08:45:51Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-CPPMAN-CVE-2026-126192", "record": "BREW-CPPMAN-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T08:46:26Z", "date_only": false, "value": "2026-11-13T08:46:26Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-BUKU-CVE-2026-126192", "record": "BREW-BUKU-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:46:26Z", "date_only": false, "value": "2026-11-13T08:46:26Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-BUKU-CVE-2026-126192", "record": "BREW-BUKU-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T08:46:48Z", "date_only": false, "value": "2026-11-13T08:46:48Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-DNSROBOCERT-CVE-2026-126192", "record": "BREW-DNSROBOCERT-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:46:48Z", "date_only": false, "value": "2026-11-13T08:46:48Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-DNSROBOCERT-CVE-2026-126192", "record": "BREW-DNSROBOCERT-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T08:47:21Z", "date_only": false, "value": "2026-11-13T08:47:21Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-GRAYSKULL-CVE-2026-126192", "record": "BREW-GRAYSKULL-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:47:21Z", "date_only": false, "value": "2026-11-13T08:47:21Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-GRAYSKULL-CVE-2026-126192", "record": "BREW-GRAYSKULL-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T08:48:18Z", "date_only": false, "value": "2026-11-13T08:48:18Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-FAVA-CVE-2026-126192", "record": "BREW-FAVA-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:48:18Z", "date_only": false, "value": "2026-11-13T08:48:18Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-FAVA-CVE-2026-126192", "record": "BREW-FAVA-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T08:50:56Z", "date_only": false, "value": "2026-11-13T08:50:56Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-GDOWN-CVE-2026-126192", "record": "BREW-GDOWN-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T08:50:56Z", "date_only": false, "value": "2026-11-13T08:50:56Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-GDOWN-CVE-2026-126192", "record": "BREW-GDOWN-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:00:04Z", "date_only": false, "value": "2026-11-13T09:00:04Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-GIMME-AWS-CREDS-CVE-2026-126192", "record": "BREW-GIMME-AWS-CREDS-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:00:04Z", "date_only": false, "value": "2026-11-13T09:00:04Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-GIMME-AWS-CREDS-CVE-2026-126192", "record": "BREW-GIMME-AWS-CREDS-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:09:38Z", "date_only": false, "value": "2026-11-13T09:09:38Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MANIM-CVE-2026-126192", "record": "BREW-MANIM-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:09:38Z", "date_only": false, "value": "2026-11-13T09:09:38Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MANIM-CVE-2026-126192", "record": "BREW-MANIM-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:11:22Z", "date_only": false, "value": "2026-11-13T09:11:22Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-SICKCHILL-CVE-2026-126192", "record": "BREW-SICKCHILL-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:11:22Z", "date_only": false, "value": "2026-11-13T09:11:22Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-SICKCHILL-CVE-2026-126192", "record": "BREW-SICKCHILL-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:13:03Z", "date_only": false, "value": "2026-11-13T09:13:03Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-OKTA-AWSCLI-CVE-2026-126192", "record": "BREW-OKTA-AWSCLI-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:13:03Z", "date_only": false, "value": "2026-11-13T09:13:03Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-OKTA-AWSCLI-CVE-2026-126192", "record": "BREW-OKTA-AWSCLI-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:15:00Z", "date_only": false, "value": "2026-11-13T09:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-ONION-LOCATION-CVE-2026-126192", "record": "BREW-ONION-LOCATION-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:15:00Z", "date_only": false, "value": "2026-11-13T09:15:00Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-ONION-LOCATION-CVE-2026-126192", "record": "BREW-ONION-LOCATION-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:43:17Z", "date_only": false, "value": "2026-11-13T09:43:17Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-AWS-GOOGLE-AUTH-CVE-2026-126192", "record": "BREW-AWS-GOOGLE-AUTH-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:43:17Z", "date_only": false, "value": "2026-11-13T09:43:17Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-AWS-GOOGLE-AUTH-CVE-2026-126192", "record": "BREW-AWS-GOOGLE-AUTH-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:49:02Z", "date_only": false, "value": "2026-11-13T09:49:02Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-CVE-BIN-TOOL-CVE-2026-126192", "record": "BREW-CVE-BIN-TOOL-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:49:02Z", "date_only": false, "value": "2026-11-13T09:49:02Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-CVE-BIN-TOOL-CVE-2026-126192", "record": "BREW-CVE-BIN-TOOL-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:49:06Z", "date_only": false, "value": "2026-11-13T09:49:06Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-SUBLIMINAL-CVE-2026-126192", "record": "BREW-SUBLIMINAL-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:49:06Z", "date_only": false, "value": "2026-11-13T09:49:06Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-SUBLIMINAL-CVE-2026-126192", "record": "BREW-SUBLIMINAL-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:52:00Z", "date_only": false, "value": "2026-11-13T09:52:00Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-PYSPELLING-CVE-2026-126192", "record": "BREW-PYSPELLING-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:52:00Z", "date_only": false, "value": "2026-11-13T09:52:00Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-PYSPELLING-CVE-2026-126192", "record": "BREW-PYSPELLING-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:52:51Z", "date_only": false, "value": "2026-11-13T09:52:51Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-AIDER-CVE-2026-126192", "record": "BREW-AIDER-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:52:51Z", "date_only": false, "value": "2026-11-13T09:52:51Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-AIDER-CVE-2026-126192", "record": "BREW-AIDER-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:53:21Z", "date_only": false, "value": "2026-11-13T09:53:21Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-AQTINSTALL-CVE-2026-126192", "record": "BREW-AQTINSTALL-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:53:21Z", "date_only": false, "value": "2026-11-13T09:53:21Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-AQTINSTALL-CVE-2026-126192", "record": "BREW-AQTINSTALL-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:55:30Z", "date_only": false, "value": "2026-11-13T09:55:30Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-BBOT-CVE-2026-126192", "record": "BREW-BBOT-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:55:30Z", "date_only": false, "value": "2026-11-13T09:55:30Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-BBOT-CVE-2026-126192", "record": "BREW-BBOT-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T09:58:16Z", "date_only": false, "value": "2026-11-13T09:58:16Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-JUPYTERLAB-CVE-2026-126192", "record": "BREW-JUPYTERLAB-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:58:16Z", "date_only": false, "value": "2026-11-13T09:58:16Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-JUPYTERLAB-CVE-2026-126192", "record": "BREW-JUPYTERLAB-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:00:21Z", "date_only": false, "value": "2026-11-13T10:00:21Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-FANFICFARE-CVE-2026-126192", "record": "BREW-FANFICFARE-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:00:21Z", "date_only": false, "value": "2026-11-13T10:00:21Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-FANFICFARE-CVE-2026-126192", "record": "BREW-FANFICFARE-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:01:49Z", "date_only": false, "value": "2026-11-13T10:01:49Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MCP-ATLASSIAN-CVE-2026-126192", "record": "BREW-MCP-ATLASSIAN-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:01:49Z", "date_only": false, "value": "2026-11-13T10:01:49Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MCP-ATLASSIAN-CVE-2026-126192", "record": "BREW-MCP-ATLASSIAN-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:06:32Z", "date_only": false, "value": "2026-11-13T10:06:32Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-CLOUDSPLAINING-CVE-2026-126192", "record": "BREW-CLOUDSPLAINING-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:06:32Z", "date_only": false, "value": "2026-11-13T10:06:32Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-CLOUDSPLAINING-CVE-2026-126192", "record": "BREW-CLOUDSPLAINING-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:09:24Z", "date_only": false, "value": "2026-11-13T10:09:24Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-ENEX2NOTION-CVE-2026-126192", "record": "BREW-ENEX2NOTION-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:09:24Z", "date_only": false, "value": "2026-11-13T10:09:24Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-ENEX2NOTION-CVE-2026-126192", "record": "BREW-ENEX2NOTION-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:13:07Z", "date_only": false, "value": "2026-11-13T10:13:07Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-FORD-CVE-2026-126192", "record": "BREW-FORD-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:13:07Z", "date_only": false, "value": "2026-11-13T10:13:07Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-FORD-CVE-2026-126192", "record": "BREW-FORD-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:14:29Z", "date_only": false, "value": "2026-11-13T10:14:29Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-LEXICON-CVE-2026-126192", "record": "BREW-LEXICON-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:14:29Z", "date_only": false, "value": "2026-11-13T10:14:29Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-LEXICON-CVE-2026-126192", "record": "BREW-LEXICON-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:17:43Z", "date_only": false, "value": "2026-11-13T10:17:43Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MISTRAL-VIBE-CVE-2026-126192", "record": "BREW-MISTRAL-VIBE-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:17:43Z", "date_only": false, "value": "2026-11-13T10:17:43Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MISTRAL-VIBE-CVE-2026-126192", "record": "BREW-MISTRAL-VIBE-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:24:15Z", "date_only": false, "value": "2026-11-13T10:24:15Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-GPTLINE-CVE-2026-126192", "record": "BREW-GPTLINE-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:24:15Z", "date_only": false, "value": "2026-11-13T10:24:15Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-GPTLINE-CVE-2026-126192", "record": "BREW-GPTLINE-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:24:39Z", "date_only": false, "value": "2026-11-13T10:24:39Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MAIGRET-CVE-2026-126192", "record": "BREW-MAIGRET-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:24:39Z", "date_only": false, "value": "2026-11-13T10:24:39Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MAIGRET-CVE-2026-126192", "record": "BREW-MAIGRET-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:29:16Z", "date_only": false, "value": "2026-11-13T10:29:16Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-THEHARVESTER-CVE-2026-126192", "record": "BREW-THEHARVESTER-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:29:16Z", "date_only": false, "value": "2026-11-13T10:29:16Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-THEHARVESTER-CVE-2026-126192", "record": "BREW-THEHARVESTER-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:33:45Z", "date_only": false, "value": "2026-11-13T10:33:45Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-TOOT-CVE-2026-126192", "record": "BREW-TOOT-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:33:45Z", "date_only": false, "value": "2026-11-13T10:33:45Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-TOOT-CVE-2026-126192", "record": "BREW-TOOT-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:39:24Z", "date_only": false, "value": "2026-11-13T10:39:24Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-CHECKOV-CVE-2026-126192", "record": "BREW-CHECKOV-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:39:24Z", "date_only": false, "value": "2026-11-13T10:39:24Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-CHECKOV-CVE-2026-126192", "record": "BREW-CHECKOV-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:42:28Z", "date_only": false, "value": "2026-11-13T10:42:28Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-ADR-VIEWER-CVE-2026-126192", "record": "BREW-ADR-VIEWER-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:42:28Z", "date_only": false, "value": "2026-11-13T10:42:28Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-ADR-VIEWER-CVE-2026-126192", "record": "BREW-ADR-VIEWER-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:43:17Z", "date_only": false, "value": "2026-11-13T10:43:17Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-FLEXGET-CVE-2026-126192", "record": "BREW-FLEXGET-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:43:17Z", "date_only": false, "value": "2026-11-13T10:43:17Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-FLEXGET-CVE-2026-126192", "record": "BREW-FLEXGET-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:47:32Z", "date_only": false, "value": "2026-11-13T10:47:32Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-CONFLUENCE-MARKDOWN-EXPORTER-CVE-2026-126192", "record": "BREW-CONFLUENCE-MARKDOWN-EXPORTER-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:47:32Z", "date_only": false, "value": "2026-11-13T10:47:32Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-CONFLUENCE-MARKDOWN-EXPORTER-CVE-2026-126192", "record": "BREW-CONFLUENCE-MARKDOWN-EXPORTER-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T10:59:02Z", "date_only": false, "value": "2026-11-13T10:59:02Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-WIK-CVE-2026-126192", "record": "BREW-WIK-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T10:59:02Z", "date_only": false, "value": "2026-11-13T10:59:02Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-WIK-CVE-2026-126192", "record": "BREW-WIK-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T11:06:00Z", "date_only": false, "value": "2026-11-13T11:06:00Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-PFERD-CVE-2026-126192", "record": "BREW-PFERD-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T11:06:00Z", "date_only": false, "value": "2026-11-13T11:06:00Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-PFERD-CVE-2026-126192", "record": "BREW-PFERD-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T11:15:57Z", "date_only": false, "value": "2026-11-13T11:15:57Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-REDO-CVE-2026-126192", "record": "BREW-REDO-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T11:15:57Z", "date_only": false, "value": "2026-11-13T11:15:57Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-REDO-CVE-2026-126192", "record": "BREW-REDO-CVE-2026-126192", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T11:33:41Z", "date_only": false, "value": "2026-11-13T11:33:41Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-PAPIS-CVE-2026-126192", "record": "BREW-PAPIS-CVE-2026-126192", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T11:33:41Z", "date_only": false, "value": "2026-11-13T11:33:41Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-PAPIS-CVE-2026-126192", "record": "BREW-PAPIS-CVE-2026-126192", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T21:29:55.243Z", "anchors": {"origin": {"timestamp": "2026-11-12T17:09:14.205Z", "date_only": false, "value": "2026-11-12T17:09:14.205Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126192", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T17:09:14.205Z", "date_only": false, "value": "2026-11-12T17:09:14.205Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126192", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-13T00:45:18Z", "date_only": false, "value": "2026-11-13T00:45:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "record": "CVE-2026-126192", "field": "creation_timestamp", "uuid": "7b1dc8f6-2c5b-497f-9410-ff8ea4c46cf6", "url": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 27363.795, "hours": 7.601054166666666, "days": 0.31671059027777776, "min_seconds": 27363.795, "max_seconds": 27363.795, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T17:09:14.205Z", "date_only": false, "value": "2026-11-12T17:09:14.205Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126192", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T00:45:18Z", "date_only": false, "value": "2026-11-13T00:45:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "record": "CVE-2026-126192", "field": "creation_timestamp", "uuid": "7b1dc8f6-2c5b-497f-9410-ff8ea4c46cf6", "url": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 102041.038407, "hours": 28.344732890833335, "days": 1.1810305371180556, "min_seconds": 102041.038407, "max_seconds": 102041.038407, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T17:09:14.205Z", "date_only": false, "value": "2026-11-12T17:09:14.205Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126192", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T21:29:55.243Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 74677.243407, "hours": 20.743678724166667, "days": 0.8643199468402778, "min_seconds": 74677.243407, "max_seconds": 74677.243407, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-13T00:45:18Z", "date_only": false, "value": "2026-11-13T00:45:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "record": "CVE-2026-126192", "field": "creation_timestamp", "uuid": "7b1dc8f6-2c5b-497f-9410-ff8ea4c46cf6", "url": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-13T21:29:55.243Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}