{"metadata": {"vulnerability": "CVE-2026-127111", "count": 18, "kinds": {"milestone": 5, "sighting": 4, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-127111", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T15:11:23.624Z", "date_only": false, "value": "2026-11-12T15:11:23.624Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-127111", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T15:53:16.849Z", "date_only": false, "value": "2026-11-12T15:53:16.849Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-127111", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T15:53:16.849Z", "date_only": false, "value": "2026-11-12T15:53:16.849Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-127111", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T15:59:40.297Z", "date_only": false, "value": "2026-11-12T15:59:40.297890Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117604298240122359", "record": "CVE-2026-127111", "field": "creation_timestamp", "uuid": "01a51cf7-7749-40ab-99f0-e05d99d30d7c", "content": "CVE-2026-127111 SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.\nhttps://www.cve.org/CVERecord?id=CVE-2026-127111https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13https://www.vulncheck.com/advisories/sogo-before-unauthenticated-password-recovery-brute-force#Alinto #sogo#CVE_2026_127111#bot", "url": "https://infosec.exchange/users/cve/statuses/117604298240122359"}, {"timestamp": "2026-11-12T16:19:07Z", "date_only": false, "value": "2026-11-12T16:19:07Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J27V-488J-289H", "record": "GHSA-J27V-488J-289H", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-12T16:19:07.260Z", "date_only": false, "value": "2026-11-12T16:19:07.260", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-127111", "record": "FKIE_CVE-2026-127111", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T16:19:07.527Z", "date_only": false, "value": "2026-11-12T16:19:07.527", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-127111", "record": "FKIE_CVE-2026-127111", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T17:10:06.227Z", "date_only": false, "value": "2026-11-12T17:10:06.227137Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n24xl2d34e2k", "record": "CVE-2026-127111", "field": "creation_timestamp", "uuid": "21c00484-576a-42e9-93c0-63d3dd38d9ea", "content": "CVE-2026-127111 - sogo\nVersions of SOGo prior to 5.12.13 let anyone repeatedly try to answer the password\u2011recovery secret question without any limit. By guessing correctly, an attacker can obtain a reset token\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sogo #alinto #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n24xl2d34e2k"}, {"timestamp": "2026-11-12T18:07:27.618Z", "date_only": false, "value": "2026-11-12T18:07:27.618794Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3n252rd5ln62x", "record": "CVE-2026-127111", "field": "creation_timestamp", "uuid": "33520369-d041-4dd7-a86a-8e3dafe9f395", "content": "\ud83d\udea8 CVE-2026-127111 \u2014 CVSS 9.1 CRITICAL\n\nSOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability tha...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-127111\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3n252rd5ln62x"}, {"timestamp": "2026-11-12T18:31:46Z", "date_only": false, "value": "2026-11-12T18:31:46Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J27V-488J-289H", "record": "GHSA-J27V-488J-289H", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T18:31:46Z", "date_only": false, "value": "2026-11-12T18:31:46Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J27V-488J-289H", "record": "GHSA-J27V-488J-289H", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-127111", "record": "UBUNTU-CVE-2026-127111", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-127111", "record": "UBUNTU-CVE-2026-127111", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T18:39:48.154Z", "date_only": false, "value": "2026-11-13T18:39:48.154981Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-127111", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T18:41:16.415Z", "date_only": false, "value": "2026-11-13T18:41:16.415Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-127111", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T18:41:16.415Z", "date_only": false, "value": "2026-11-13T18:41:16.415Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-127111", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-14T15:09:17.361Z", "date_only": false, "value": "2026-11-14T15:09:17.361542Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3n2brqu2ehq27", "record": "CVE-2026-127111", "field": "creation_timestamp", "uuid": "4dbd4eb7-716a-48b2-a4a4-81814616fc34", "content": "Patch watch: CVE-2026-127111 (Alinto sogo, CVSS 9.1). SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to\u2026 No public exploit reported yet. #CVE #infosec\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3n2brqu2ehq27"}], "metrics": {"as_of": "2026-11-15T16:09:19.126Z", "anchors": {"origin": {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-127111", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-127111", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 317359.126719, "hours": 88.1553129775, "days": 3.6731380407291665, "min_seconds": 230959.126719, "max_seconds": 317359.126719, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-127111", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-15T16:09:19.126Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}