{"metadata": {"vulnerability": "CVE-2026-126274", "count": 12, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 7}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126274", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T20:14:15.971Z", "date_only": false, "value": "2026-11-10T20:14:15.971Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-126274", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T09:36:44.396Z", "date_only": false, "value": "2026-11-13T09:36:44.396Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126274", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T09:36:44.396Z", "date_only": false, "value": "2026-11-13T09:36:44.396Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126274", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T10:17:30Z", "date_only": false, "value": "2026-11-13T10:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-Q33X-F753-X487", "record": "GHSA-Q33X-F753-X487", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T11:07:43.751Z", "date_only": false, "value": "2026-11-13T11:07:43.751913Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117608812594232021", "record": "CVE-2026-126274", "field": "creation_timestamp", "uuid": "79b4caa8-7352-4909-8dbd-f55c8ffd6017", "content": "CVE-2026-126274 NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.\nhttps://www.cve.org/CVERecord?id=CVE-2026-126274https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9xhttps://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog#nocodb#CVE_2026_126274#bot", "url": "https://infosec.exchange/users/cve/statuses/117608812594232021"}, {"timestamp": "2026-11-13T11:30:03.889Z", "date_only": false, "value": "2026-11-13T11:30:03.889064Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n26uzw4fbj2u", "record": "CVE-2026-126274", "field": "creation_timestamp", "uuid": "f7c0ce29-5309-48c0-a777-a6d6734b5841", "content": "CVE-2026-126274 - nocodb\nIn versions of NocoDB released before August 2026, a user who can create content can place malicious code into the names of columns or tables. When another user later tries to delete that\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nocodb #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n26uzw4fbj2u"}, {"timestamp": "2026-11-13T12:31:14Z", "date_only": false, "value": "2026-11-13T12:31:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-Q33X-F753-X487", "record": "GHSA-Q33X-F753-X487", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:31:14Z", "date_only": false, "value": "2026-11-13T12:31:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-Q33X-F753-X487", "record": "GHSA-Q33X-F753-X487", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T15:35:37.552Z", "date_only": false, "value": "2026-11-13T15:35:37.552966Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126274", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T15:53:19.105Z", "date_only": false, "value": "2026-11-13T15:53:19.105Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-126274", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T15:53:19.105Z", "date_only": false, "value": "2026-11-13T15:53:19.105Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126274", "field": "containers.adp.0.providerMetadata.dateUpdated"}], "metrics": {"as_of": "2026-11-13T23:34:45.486Z", "anchors": {"origin": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126274", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126274", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1553685.486374, "hours": 431.57930177055556, "days": 17.98247090710648, "min_seconds": 1467285.486374, "max_seconds": 1553685.486374, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126274", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T23:34:45.486Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}