{"metadata": {"vulnerability": "CVE-2026-16237", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-07-20T01:55:06.428Z", "date_only": false, "value": "2026-07-20T01:55:06.428Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-16237", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T14:15:30.710Z", "date_only": false, "value": "2026-11-12T14:15:30.710Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16237", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T14:15:30.710Z", "date_only": false, "value": "2026-11-12T14:15:30.710Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / PostgreSQL", "record": "CVE-2026-16237", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T14:55:13.821Z", "date_only": false, "value": "2026-11-12T14:55:13.821115Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117604044852210626", "record": "CVE-2026-16237", "field": "creation_timestamp", "uuid": "da2ad04d-9264-4cee-87c1-eaf89ca843b7", "content": "CVE-2026-120154 PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE.  Unlike CVE-2026-16237, this does not facilitate improper writes.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.\nhttps://www.cve.org/CVERecord?id=CVE-2026-120154https://www.postgresql.org/support/security/CVE-2026-120154/#postgresql#CVE_2026_120154#bot", "url": "https://infosec.exchange/users/cve/statuses/117604044852210626"}, {"timestamp": "2026-11-12T14:57:15.279Z", "date_only": false, "value": "2026-11-12T14:57:15.279907Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117604052811246557", "record": "CVE-2026-16237", "field": "creation_timestamp", "uuid": "31b7e231-1eff-468b-8b6d-3b2cea5c7183", "content": "CVE-2026-16237 PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE.  This bypasses the view's WHERE condition, whether or not the view is a security_barrier view.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.\nhttps://www.cve.org/CVERecord?id=CVE-2026-16237https://www.postgresql.org/support/security/CVE-2026-16237/#postgresql#CVE_2026_16237#bot", "url": "https://infosec.exchange/users/cve/statuses/117604052811246557"}, {"timestamp": "2026-11-12T15:17:50Z", "date_only": false, "value": "2026-11-12T15:17:50Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WRM7-CRVQ-VPV9", "record": "GHSA-WRM7-CRVQ-VPV9", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-12T15:17:50.030Z", "date_only": false, "value": "2026-11-12T15:17:50.030", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16237", "record": "FKIE_CVE-2026-16237", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T15:32:01Z", "date_only": false, "value": "2026-11-12T15:32:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WRM7-CRVQ-VPV9", "record": "GHSA-WRM7-CRVQ-VPV9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T15:32:01Z", "date_only": false, "value": "2026-11-12T15:32:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WRM7-CRVQ-VPV9", "record": "GHSA-WRM7-CRVQ-VPV9", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T21:10:19.107Z", "date_only": false, "value": "2026-11-12T21:10:19.107281Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16237", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-12T21:10:19.107Z", "date_only": false, "value": "2026-11-12T21:10:19.107281Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16237", "record": "FKIE_CVE-2026-16237", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-12T21:42:02.923Z", "date_only": false, "value": "2026-11-12T21:42:02.923Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-16237", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T21:42:02.923Z", "date_only": false, "value": "2026-11-12T21:42:02.923Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16237", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T22:19:21.690Z", "date_only": false, "value": "2026-11-12T22:19:21.690", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16237", "record": "FKIE_CVE-2026-16237", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T05:25:29.345Z", "anchors": {"origin": {"timestamp": "2026-11-12T14:15:30.710Z", "date_only": false, "value": "2026-11-12T14:15:30.710Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16237", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T14:15:30.710Z", "date_only": false, "value": "2026-11-12T14:15:30.710Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16237", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 54598.635817, "hours": 15.166287726944445, "days": 0.6319286552893518, "min_seconds": 54598.635817, "max_seconds": 54598.635817, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T14:15:30.710Z", "date_only": false, "value": "2026-11-12T14:15:30.710Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16237", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T05:25:29.345Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}