{"metadata": {"vulnerability": "CVE-2026-19677", "count": 11, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-08-12T22:38:37.258Z", "date_only": false, "value": "2026-08-12T22:38:37.258Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19677", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T01:21:08.272Z", "date_only": false, "value": "2026-10-23T01:21:08.272Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T01:21:08.272Z", "date_only": false, "value": "2026-10-23T01:21:08.272Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19677", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T01:21:08.272Z", "date_only": false, "value": "2026-10-23T01:21:08.272Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / MON-CSIRT", "record": "CVE-2026-19677", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T01:38:42.282Z", "date_only": false, "value": "2026-10-23T01:38:42.282464Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117487666580278343", "record": "CVE-2026-19677", "field": "creation_timestamp", "uuid": "628ca0b0-be2d-4eae-b3b0-2d14c3975765", "content": "CVE-2026-19677 Authentication Bypass Leading to Server-Side Command Execution An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.\nhttps://www.cve.org/CVERecord?id=CVE-2026-19677https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Noteshttps://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609#onPhase #onPhaseForms#CVE_2026_19677#bot", "url": "https://infosec.exchange/users/cve/statuses/117487666580278343"}, {"timestamp": "2026-10-23T02:16:57Z", "date_only": false, "value": "2026-10-23T02:16:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-542F-HR4V-MV7F", "record": "GHSA-542F-HR4V-MV7F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T02:16:57.560Z", "date_only": false, "value": "2026-10-23T02:16:57.560", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19677", "record": "FKIE_CVE-2026-19677", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T03:00:26.654Z", "date_only": false, "value": "2026-10-23T03:00:26.654027Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117487987975478199", "record": "cve-2026-19677", "field": "creation_timestamp", "uuid": "e3bed056-e42f-4663-945d-4a3e66acf0a9", "content": "CVE-2026-19677: CRITICAL vuln (CVSS 9.3) in onPhase Forms 11.0.14 \u2014 missing auth lets remote attackers impersonate users, escalate to TenantAdmin, and execute OS commands. Restrict registration form access & watch logs. https://radar.offseq.com/threat/cve-2026-19677-cwe-306-missing-authentication-for-critical-function-in-onphase-onphase-forms-aa9ba384e28e3853 #OffSeq #CVE #onPhase #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/117487987975478199"}, {"timestamp": "2026-10-23T03:30:23Z", "date_only": false, "value": "2026-10-23T03:30:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-542F-HR4V-MV7F", "record": "GHSA-542F-HR4V-MV7F", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T03:30:23Z", "date_only": false, "value": "2026-10-23T03:30:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-542F-HR4V-MV7F", "record": "GHSA-542F-HR4V-MV7F", "field": "modified"}, {"timestamp": "2026-10-23T19:45:03.547Z", "date_only": false, "value": "2026-10-23T19:45:03.547", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19677", "record": "FKIE_CVE-2026-19677", "field": "lastModified"}], "metrics": {"as_of": "2026-10-30T21:20:20.208Z", "anchors": {"origin": {"timestamp": "2026-10-23T01:21:08.272Z", "date_only": false, "value": "2026-10-23T01:21:08.272Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T01:21:08.272Z", "date_only": false, "value": "2026-10-23T01:21:08.272Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 676751.936046, "hours": 187.98664890166665, "days": 7.8327770375694445, "min_seconds": 676751.936046, "max_seconds": 676751.936046, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T01:21:08.272Z", "date_only": false, "value": "2026-10-23T01:21:08.272Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T21:20:20.208Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}