{"metadata": {"vulnerability": "CVE-2026-34157", "count": 12, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 4}}, "data": [{"timestamp": "2026-03-25T20:12:04.196Z", "date_only": false, "value": "2026-03-25T20:12:04.196Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-34157", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-18T16:00:08Z", "date_only": false, "value": "2026-10-18T16:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105877", "record": "CVE-2026-34157", "field": "creation_timestamp", "uuid": "f92d9d89-cf79-4b00-8a56-d4318c8da782", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34157-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-18 15:20:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105877", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-18T16:00:08Z", "date_only": false, "value": "2026-10-18T16:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/105877", "record": "CVE-2026-34157", "field": "creation_timestamp", "uuid": "8d66cbc3-d57b-4db5-9f63-7cf868ac5f31", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34157-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-18 15:20:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105877"}, {"timestamp": "2026-10-27T13:29:47Z", "date_only": false, "value": "2026-10-27T13:29:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-47HV-J4PX-H3C9", "record": "GHSA-47HV-J4PX-H3C9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-27T13:29:47Z", "date_only": false, "value": "2026-10-27T13:29:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-47HV-J4PX-H3C9", "record": "GHSA-47HV-J4PX-H3C9", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-27T15:00:05.978Z", "date_only": false, "value": "2026-10-27T15:00:05.978814Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myuitu3xpk22", "record": "CVE-2026-34157", "field": "creation_timestamp", "uuid": "e175a709-ea60-438f-9a15-190b253cec91", "content": "CVE-2026-34157 - wailsapp\nThe Wails v2 framework can be tricked into accepting web pages from sites it should block because its origin\u2011checking code treats wildcard characters too loosely. An attacker who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wailsapp #Golang #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myuitu3xpk22"}, {"timestamp": "2026-11-05T20:26:04.218Z", "date_only": false, "value": "2026-11-05T20:26:04.218Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-34157", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T20:26:04.218Z", "date_only": false, "value": "2026-11-05T20:26:04.218Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-34157", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T20:26:04.218Z", "date_only": false, "value": "2026-11-05T20:26:04.218Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-34157", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T20:55:32.439Z", "date_only": false, "value": "2026-11-05T20:55:32.439963Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117565825477143201", "record": "CVE-2026-34157", "field": "creation_timestamp", "uuid": "d2eb1ff3-3cd0-4bc4-b3b5-c04ca396f7e1", "content": "CVE-2026-34157 Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-34157https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9https://github.com/wailsapp/wails/pull/5074https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81https://github.com/wailsapp/wails/releases/tag/v2.13.0#wailsapp #wails#CVE_2026_34157#bot", "url": "https://infosec.exchange/users/cve/statuses/117565825477143201"}, {"timestamp": "2026-11-05T21:18:47.300Z", "date_only": false, "value": "2026-11-05T21:18:47.300", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-34157", "record": "FKIE_CVE-2026-34157", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T21:18:47.300Z", "date_only": false, "value": "2026-11-05T21:18:47.300", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-34157", "record": "FKIE_CVE-2026-34157", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-06T00:16:07.056Z", "anchors": {"origin": {"timestamp": "2026-10-27T13:29:47Z", "date_only": false, "value": "2026-10-27T13:29:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-47HV-J4PX-H3C9", "record": "GHSA-47HV-J4PX-H3C9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T13:29:47Z", "date_only": false, "value": "2026-10-27T13:29:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-47HV-J4PX-H3C9", "record": "GHSA-47HV-J4PX-H3C9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-10-18T16:00:08Z", "date_only": false, "value": "2026-10-18T16:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105877", "record": "CVE-2026-34157", "field": "creation_timestamp", "uuid": "f92d9d89-cf79-4b00-8a56-d4318c8da782", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34157-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-18 15:20:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105877", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -768579.0, "hours": -213.49416666666667, "days": -8.895590277777778, "min_seconds": -768579.0, "max_seconds": -768579.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-27T13:29:47Z", "date_only": false, "value": "2026-10-27T13:29:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-47HV-J4PX-H3C9", "record": "GHSA-47HV-J4PX-H3C9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-18T16:00:08Z", "date_only": false, "value": "2026-10-18T16:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105877", "record": "CVE-2026-34157", "field": "creation_timestamp", "uuid": "f92d9d89-cf79-4b00-8a56-d4318c8da782", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34157-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-18 15:20:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105877", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 816380.056382, "hours": 226.7722378838889, "days": 9.448843245162037, "min_seconds": 816380.056382, "max_seconds": 816380.056382, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T13:29:47Z", "date_only": false, "value": "2026-10-27T13:29:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-47HV-J4PX-H3C9", "record": "GHSA-47HV-J4PX-H3C9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-06T00:16:07.056Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 1584959.056382, "hours": 440.26640455055554, "days": 18.344433522939816, "min_seconds": 1584959.056382, "max_seconds": 1584959.056382, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-18T16:00:08Z", "date_only": false, "value": "2026-10-18T16:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105877", "record": "CVE-2026-34157", "field": "creation_timestamp", "uuid": "f92d9d89-cf79-4b00-8a56-d4318c8da782", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-34157-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-18 15:20:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105877", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-06T00:16:07.056Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}