{"metadata": {"vulnerability": "CVE-2026-46454", "count": 25, "kinds": {"milestone": 5, "sighting": 6, "kev": 0, "other": 14}}, "data": [{"timestamp": "2026-05-14T08:45:22.737Z", "date_only": false, "value": "2026-05-14T08:45:22.737Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-46454", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-05T19:37:23.534Z", "date_only": false, "value": "2026-07-05T19:37:23.534111Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwd6qnra62b", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "520a5c16-101f-4cd9-96d5-c2b06d0ecfda", "content": "CVE-2026-46454: Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwd6qnra62b"}, {"timestamp": "2026-07-05T22:00:00Z", "date_only": false, "value": "2026-07-05T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-05T22:00:00Z", "date_only": false, "value": "2026-07-05T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-05T22:00:00Z", "date_only": false, "value": "2026-07-05T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "vulnerabilities.6.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T07:56:14.036Z", "date_only": false, "value": "2026-07-06T07:56:14.036Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-46454", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T07:56:14.036Z", "date_only": false, "value": "2026-07-06T07:56:14.036Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-46454", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-06T09:16:36Z", "date_only": false, "value": "2026-07-06T09:16:36Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R9CC-J7WR-P329", "record": "GHSA-R9CC-J7WR-P329", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-06T09:16:36.457Z", "date_only": false, "value": "2026-07-06T09:16:36.457", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46454", "record": "FKIE_CVE-2026-46454", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T09:25:11.555Z", "date_only": false, "value": "2026-07-06T09:25:11.555Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-46454", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-06T09:30:28Z", "date_only": false, "value": "2026-07-06T09:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R9CC-J7WR-P329", "record": "GHSA-R9CC-J7WR-P329", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T17:41:16.224Z", "date_only": false, "value": "2026-07-06T17:41:16.224857Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-46454", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2026-07-06T17:41:16.224Z", "date_only": false, "value": "2026-07-06T17:41:16.224857Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46454", "record": "FKIE_CVE-2026-46454", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-06T17:41:19.974Z", "date_only": false, "value": "2026-07-06T17:41:19.974Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-46454", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-06T17:41:19.974Z", "date_only": false, "value": "2026-07-06T17:41:19.974Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-46454", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-06T18:26:04.940Z", "date_only": false, "value": "2026-07-06T18:26:04.940886Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpypo5e3fk2s", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "539db8f8-2dd3-4d46-9b47-b383a3469ee0", "content": "CVE-2026-46454 - apache camel\nApache Camel's CometD component doesn't check incoming messages for security. This allows unauthenticated clients to inject custom headers that can affect how the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachecamel #apachefoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mpypo5e3fk2s"}, {"timestamp": "2026-07-06T22:00:00Z", "date_only": false, "value": "2026-07-06T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-07-06T22:00:00Z", "date_only": false, "value": "2026-07-06T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-07-07T07:46:44.546Z", "date_only": false, "value": "2026-07-07T07:46:44.546+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-09T03:37:51.867Z", "date_only": false, "value": "2026-07-09T03:37:51.867022Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6pgnvwbd2f", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "ec6ebacd-bd93-4d61-9c45-0498077ad61f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46454 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Apache Camel Cometd: \u0443\u0433\u0440\u043e\u0437\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/968BE81B-7086-4A8D-BDCD-1B1A122E9771", "url": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6pgnvwbd2f"}, {"timestamp": "2026-07-09T05:07:07.562Z", "date_only": false, "value": "2026-07-09T05:07:07.562711Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mq6ugb4t7n2m", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "8bd9beac-a5ff-4277-901c-cebdba7fba56", "content": "\ud83d\udccc CVE-2026-46454 - Improper Input Validation vulnerability in Apache Camel Cometd Component.\n\nThe camel-cometd component maps inbound Bayeux (CometD) message headers int... https://www.cyberhub.blog/cves/CVE-2026-46454", "url": "https://bsky.app/profile/cyberhub.blog/post/3mq6ugb4t7n2m"}, {"timestamp": "2026-07-16T12:00:07.226Z", "date_only": false, "value": "2026-07-16T12:00:07.226404Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/93232", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "96da06fe-db80-4211-a026-311a6597ad46", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46454\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-13 12:58:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46454 \u2014 Apache Camel camel-cometd inbound Bayeux header injection (unauthenticated Camel control-header injection \u2192 downstream producer steering / RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93232"}, {"timestamp": "2026-07-17T00:00:49.538Z", "date_only": false, "value": "2026-07-17T00:00:49.538080Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93232", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "14efcb58-e21b-41ca-b65d-c931413591fc", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46454\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-13 12:58:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46454 \u2014 Apache Camel camel-cometd inbound Bayeux header injection (unauthenticated Camel control-header injection \u2192 downstream producer steering / RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93232", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-26T18:03:03Z", "date_only": false, "value": "2026-08-26T18:03:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R9CC-J7WR-P329", "record": "GHSA-R9CC-J7WR-P329", "field": "modified"}, {"timestamp": "2026-10-25T15:10:00.147Z", "date_only": false, "value": "2026-10-25T15:10:00.147", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46454", "record": "FKIE_CVE-2026-46454", "field": "lastModified"}], "metrics": {"as_of": "2026-10-28T22:14:57.471Z", "anchors": {"origin": {"timestamp": "2026-07-05T22:00:00Z", "date_only": false, "value": "2026-07-05T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-05T22:00:00Z", "date_only": false, "value": "2026-07-05T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-17T00:00:49.538Z", "date_only": false, "value": "2026-07-17T00:00:49.538080Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93232", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "14efcb58-e21b-41ca-b65d-c931413591fc", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46454\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-13 12:58:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46454 \u2014 Apache Camel camel-cometd inbound Bayeux header injection (unauthenticated Camel control-header injection \u2192 downstream producer steering / RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93232", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 957649.538, "hours": 266.01376055555556, "days": 11.083906689814814, "min_seconds": 957649.538, "max_seconds": 957649.538, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-05T22:00:00Z", "date_only": false, "value": "2026-07-05T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-17T00:00:49.538Z", "date_only": false, "value": "2026-07-17T00:00:49.538080Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93232", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "14efcb58-e21b-41ca-b65d-c931413591fc", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46454\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-13 12:58:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46454 \u2014 Apache Camel camel-cometd inbound Bayeux header injection (unauthenticated Camel control-header injection \u2192 downstream producer steering / RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93232", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 9936897.471073, "hours": 2760.2492975202777, "days": 115.01038739667824, "min_seconds": 9936897.471073, "max_seconds": 9936897.471073, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-05T22:00:00Z", "date_only": false, "value": "2026-07-05T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2203", "record": "WID-SEC-W-2026-2203", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T22:14:57.471Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 8979247.933073, "hours": 2494.235536964722, "days": 103.92648070686342, "min_seconds": 8979247.933073, "max_seconds": 8979247.933073, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-17T00:00:49.538Z", "date_only": false, "value": "2026-07-17T00:00:49.538080Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93232", "record": "CVE-2026-46454", "field": "creation_timestamp", "uuid": "14efcb58-e21b-41ca-b65d-c931413591fc", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46454\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-13 12:58:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-46454 \u2014 Apache Camel camel-cometd inbound Bayeux header injection (unauthenticated Camel control-header injection \u2192 downstream producer steering / RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93232", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-28T22:14:57.471Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}