{"metadata": {"vulnerability": "CVE-2026-128047", "count": 13, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 7}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128047", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T20:45:47.416Z", "date_only": false, "value": "2026-11-12T20:45:47.416Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-128047", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T09:33:53.555Z", "date_only": false, "value": "2026-11-13T09:33:53.555Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-128047", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T09:33:53.555Z", "date_only": false, "value": "2026-11-13T09:33:53.555Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128047", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T10:18:10Z", "date_only": false, "value": "2026-11-13T10:18:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-Q785-9GHR-8QJ7", "record": "GHSA-Q785-9GHR-8QJ7", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T10:18:32.065Z", "date_only": false, "value": "2026-11-13T10:18:32.065767Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117608619148770591", "record": "CVE-2026-128047", "field": "creation_timestamp", "uuid": "a8a0a307-a497-49ff-a741-058dcb1013ed", "content": "CVE-2026-128047 OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.\nhttps://www.cve.org/CVERecord?id=CVE-2026-128047https://github.com/OpenMage/magento-lts/security/advisories/GHSA-7j66-6mw7-rgfxhttps://github.com/OpenMage/magento-lts/commit/4a8d91c692524de4a07e70af5367b6cb67a9516dhttps://github.com/OpenMage/magento-lts/commit/9f5a1c3cf63f5cf6ac9f90b041a97a474cea04c2https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-account-takeover-via-predictable-confirmation-key#OpenMage #magento-lts#CVE_2026_128047#bot", "url": "https://infosec.exchange/users/cve/statuses/117608619148770591"}, {"timestamp": "2026-11-13T12:31:39Z", "date_only": false, "value": "2026-11-13T12:31:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-Q785-9GHR-8QJ7", "record": "GHSA-Q785-9GHR-8QJ7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:31:39Z", "date_only": false, "value": "2026-11-13T12:31:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-Q785-9GHR-8QJ7", "record": "GHSA-Q785-9GHR-8QJ7", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T12:40:05.113Z", "date_only": false, "value": "2026-11-13T12:40:05.113868Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n26yx5kfw72s", "record": "CVE-2026-128047", "field": "creation_timestamp", "uuid": "61fb0a40-df60-4754-97ae-3b9f7041dd70", "content": "CVE-2026-128047 - magento-lts\nOlder OpenMage Magento LTS versions create email confirmation and password\u2011reset codes that are easy to guess. An unauthenticated attacker can repeatedly try these codes and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#magentolts #openmage #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n26yx5kfw72s"}, {"timestamp": "2026-11-13T18:09:42.453Z", "date_only": false, "value": "2026-11-13T18:09:42.453263Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-128047", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T18:09:57.197Z", "date_only": false, "value": "2026-11-13T18:09:57.197Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-128047", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T18:09:57.197Z", "date_only": false, "value": "2026-11-13T18:09:57.197Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-128047", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-14T00:20:25.978Z", "date_only": false, "value": "2026-11-14T00:20:25.978761Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/experiencedigest.bsky.social/post/3n2aa3hir3k2b", "record": "CVE-2026-128047", "field": "creation_timestamp", "uuid": "bdb67254-d120-4140-988e-9f3a52e0567a", "content": "CVE-2026-128047 (HIGH) CVSS 8.1: https://experiencedigest.org/2026/11/13/cve-high-cvss.html", "url": "https://bsky.app/profile/experiencedigest.bsky.social/post/3n2aa3hir3k2b"}], "metrics": {"as_of": "2026-11-15T19:38:45.595Z", "anchors": {"origin": {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128047", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128047", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1798725.595726, "hours": 499.64599881277775, "days": 20.81858328386574, "min_seconds": 1712325.595726, "max_seconds": 1798725.595726, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128047", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-15T19:38:45.595Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}