{"metadata": {"vulnerability": "CVE-2026-16651", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-22T18:08:54.825Z", "date_only": false, "value": "2026-07-22T18:08:54.825Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-16651", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-21T11:32:44.699Z", "date_only": false, "value": "2026-09-21T11:32:44.699Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16651", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-21T11:32:44.699Z", "date_only": false, "value": "2026-09-21T11:32:44.699Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Temporal", "record": "CVE-2026-16651", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-21T12:17:10Z", "date_only": false, "value": "2026-09-21T12:17:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G9JQ-GQ4V-4RW3", "record": "GHSA-G9JQ-GQ4V-4RW3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-21T12:17:10.167Z", "date_only": false, "value": "2026-09-21T12:17:10.167", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16651", "record": "FKIE_CVE-2026-16651", "field": "published"}, {"timestamp": "2026-09-21T12:32:36Z", "date_only": false, "value": "2026-09-21T12:32:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G9JQ-GQ4V-4RW3", "record": "GHSA-G9JQ-GQ4V-4RW3", "field": "published"}, {"timestamp": "2026-09-21T12:32:37Z", "date_only": false, "value": "2026-09-21T12:32:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G9JQ-GQ4V-4RW3", "record": "GHSA-G9JQ-GQ4V-4RW3", "field": "modified"}, {"timestamp": "2026-09-21T15:32:17.328Z", "date_only": false, "value": "2026-09-21T15:32:17.328992Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16651", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-21T15:32:17.328Z", "date_only": false, "value": "2026-09-21T15:32:17.328992Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16651", "record": "FKIE_CVE-2026-16651", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-21T15:32:34.656Z", "date_only": false, "value": "2026-09-21T15:32:34.656Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-16651", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-21T15:32:34.656Z", "date_only": false, "value": "2026-09-21T15:32:34.656Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16651", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-21T16:01:32.825Z", "date_only": false, "value": "2026-09-21T16:01:32.825979Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a", "record": "CVE-2026-16651", "field": "creation_timestamp", "uuid": "32aae6ea-b470-49c5-a09d-5f35388f0a5a", "content": "This threat intelligence briefing covers critical vulnerabilities, active malware campaigns, and emerging AI security governance:\n\n**Vulnerabilities & Advisories:** IBM released advisory AV26-943 requiring immediate patches for multiple enterprise products. Two high-severity CVEs were disclosed: CVE-2026-16651 (a DoS flaw in Temporal\u2019s SQL parser) and CVE-2026-92574 (a CRI-O checkpoint restore bypass enabling Kubernetes privilege escalation).\n\n**Active Threats:** The TASK#STOMP PowerShell backdoor is harvesting documents, Wi-Fi credentials, clipboard data, and screenshots. A sophisticated npm malware campaign evaded script defenses by hijacking core runtime functions, exfiltrated data via Slack/Telegram, used an Ethereum testnet for resilient C2, and accumulated ~2M weekly downloads.\n\n**AI & Device Security:** Five Eyes/CISA guidance recommends restricting autonomous AI agents to low-risk, non-sensitive tasks, while Orchid Security introduced identity drift detection and application-level kill-switches to govern safe AI scaling. Additional insights cover a critical disk encryption bypass in Flock ALPR cameras and security best practices for Windows 11 kiosk deployments.\n\n**Recommendation:** Organizations should apply pending patches, monitor for newly disclosed IOCs, and enforce strict identity hygiene and access controls across software supply chains and AI workloads.", "url": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a"}, {"timestamp": "2026-09-22T11:40:51.244Z", "date_only": false, "value": "2026-09-22T11:40:51.244953Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mw45fe6kuf2k", "record": "CVE-2026-16651", "field": "creation_timestamp", "uuid": "8c13e68d-6a13-4437-a7cd-2c2f458a717a", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-16651\n\ntemporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only ...", "url": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mw45fe6kuf2k"}, {"timestamp": "2026-09-22T19:40:05.870Z", "date_only": false, "value": "2026-09-22T19:40:05.870", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16651", "record": "FKIE_CVE-2026-16651", "field": "lastModified"}]}