{"metadata": {"vulnerability": "CVE-2026-126468", "count": 12, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 7}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126468", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T21:41:28.743Z", "date_only": false, "value": "2026-11-10T21:41:28.743Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-126468", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T09:35:01.841Z", "date_only": false, "value": "2026-11-13T09:35:01.841Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126468", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T09:35:01.841Z", "date_only": false, "value": "2026-11-13T09:35:01.841Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126468", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T10:17:55Z", "date_only": false, "value": "2026-11-13T10:17:55Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FGF4-RCX8-VV78", "record": "GHSA-FGF4-RCX8-VV78", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T12:31:28Z", "date_only": false, "value": "2026-11-13T12:31:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FGF4-RCX8-VV78", "record": "GHSA-FGF4-RCX8-VV78", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:31:28Z", "date_only": false, "value": "2026-11-13T12:31:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FGF4-RCX8-VV78", "record": "GHSA-FGF4-RCX8-VV78", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T12:47:35.093Z", "date_only": false, "value": "2026-11-13T12:47:35.093936Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117609205243552428", "record": "CVE-2026-126468", "field": "creation_timestamp", "uuid": "4b8807b8-3055-4b3f-8aa3-5553f20dc74a", "content": "CVE-2026-126468 OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing.\nhttps://www.cve.org/CVERecord?id=CVE-2026-126468https://github.com/openemr/openemr/security/advisories/GHSA-6h9j-m5w9-8938https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-on-reports-and-reminder-endpoints#openemr#CVE_2026_126468#bot", "url": "https://infosec.exchange/users/cve/statuses/117609205243552428"}, {"timestamp": "2026-11-13T15:35:14.126Z", "date_only": false, "value": "2026-11-13T15:35:14.126294Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126468", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T15:58:16.664Z", "date_only": false, "value": "2026-11-13T15:58:16.664Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-126468", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T15:58:16.664Z", "date_only": false, "value": "2026-11-13T15:58:16.664Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126468", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-14T04:00:03.595Z", "date_only": false, "value": "2026-11-14T04:00:03.595302Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n2ame6ptck2b", "record": "CVE-2026-126468", "field": "creation_timestamp", "uuid": "0005a46c-1c94-4ac9-8378-3d39e72cdc5a", "content": "CVE-2026-126468 - openemr\nIn versions of OpenEMR older than 8.5.0, a user who can log in but does not have special permissions can open pages that show patient reports, reminders and can start batch reminder\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openemr #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n2ame6ptck2b"}], "metrics": {"as_of": "2026-11-14T08:53:44.011Z", "anchors": {"origin": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126468", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126468", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1587224.011498, "hours": 440.89555874944443, "days": 18.370648281226853, "min_seconds": 1500824.011498, "max_seconds": 1587224.011498, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126468", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T08:53:44.011Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}