{"metadata": {"vulnerability": "CVE-2026-46649", "count": 14, "kinds": {"milestone": 3, "sighting": 5, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-05-15T20:11:54.585Z", "date_only": false, "value": "2026-05-15T20:11:54.585Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-46649", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-21T20:58:04.456Z", "date_only": false, "value": "2026-09-21T20:58:04.456Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-46649", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-21T20:58:04.456Z", "date_only": false, "value": "2026-09-21T20:58:04.456Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-46649", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-21T21:17:03.323Z", "date_only": false, "value": "2026-09-21T21:17:03.323", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46649", "record": "FKIE_CVE-2026-46649", "field": "published"}, {"timestamp": "2026-09-21T21:57:43.781Z", "date_only": false, "value": "2026-09-21T21:57:43.781026Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6edxc5mjk3766", "record": "CVE-2026-46649", "field": "creation_timestamp", "uuid": "6b9009cc-4a83-43b2-842c-1f3ad7901d17", "content": "CVE-2026-46649 - Joplin: SSO Auth Code Login Missing Rate Limiting \u2014 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint\nCVE ID : CVE-2026-46649\n \n Published : Sept. 21, 2026, 8:58 p.m. | 14\u00a0minutes ago\n \n Description : Joplin is an open source note-taking and to-do ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/6edxc5mjk3766"}, {"timestamp": "2026-09-21T22:07:23.459Z", "date_only": false, "value": "2026-09-21T22:07:23.459736Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw2pwrg2qz2g", "record": "CVE-2026-46649", "field": "creation_timestamp", "uuid": "058f0be5-7059-4cd3-9b1f-66484d5d9f0a", "content": "\ud83d\udea8 CVE-2026-46649 \u2014 CVSS 9.1 CRITICAL\n\nJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. P...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-46649\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mw2pwrg2qz2g"}, {"timestamp": "2026-09-21T22:20:05.715Z", "date_only": false, "value": "2026-09-21T22:20:05.715340Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw2qnhqvnj2y", "record": "CVE-2026-46649", "field": "creation_timestamp", "uuid": "c2c904d5-62db-417e-89fa-d48ebb53f1c9", "content": "CVE-2026-46649 - joplin\nJoplin Server versions before 3.7.2 let anyone repeatedly try a nine\u2011digit single sign\u2011on code without any limit. If the correct code is guessed, the attacker receives a full session\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#joplin #laurent22 #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mw2qnhqvnj2y"}, {"timestamp": "2026-09-22T00:03:05.336Z", "date_only": false, "value": "2026-09-22T00:03:05.336072Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/85fb1e02960a0516578c312a9bf4f913", "record": "CVE-2026-46649", "field": "creation_timestamp", "uuid": "a00bcbc2-43ed-4495-97bd-281673a40728", "content": "This September 21, 2026 threat intelligence digest highlights four critical vulnerabilities requiring immediate patching: **Joplin Server** (CVE-2026-46649) and **Warpgate** (CVE-2026-58491) contain unmitigated SSO flaws enabling credential brute-forcing and reflected XSS/open redirects, respectively; **Roundcube Webmail** (CVE-2026-48842) is actively exploited in the wild; and **Zyxel GS1900 switches** (CVE-2026-7273) feature a stack-based buffer overflow now listed in CISA\u2019s KEV database. Additionally, community reports suggest a potential compromise of the OWASP API Security page, while a weekly cyber warfare brief tracks state-aligned operations and references CVE-2026-76460/76461. Administrators are urged to prioritize updates to Joplin \u22653.7.2, Warpgate \u22650.25.5, Roundcube \u22651.6.16/1.7.1, and affected Zyxel firmware, while verifying third-party resource integrity.", "url": "https://gist.github.com/ichintu/85fb1e02960a0516578c312a9bf4f913"}, {"timestamp": "2026-09-28T20:18:43.323Z", "date_only": false, "value": "2026-09-28T20:18:43.323006Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-46649", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-28T20:18:43.323Z", "date_only": false, "value": "2026-09-28T20:18:43.323006Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46649", "record": "FKIE_CVE-2026-46649", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-28T20:18:49.471Z", "date_only": false, "value": "2026-09-28T20:18:49.471Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-46649", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-28T20:18:49.471Z", "date_only": false, "value": "2026-09-28T20:18:49.471Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-46649", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-28T21:17:17.733Z", "date_only": false, "value": "2026-09-28T21:17:17.733", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46649", "record": "FKIE_CVE-2026-46649", "field": "lastModified"}, {"timestamp": "2026-10-10T17:10:04.146Z", "date_only": false, "value": "2026-10-10T17:10:04.146040Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117417718754891227", "record": "CVE-2026-46649", "field": "creation_timestamp", "uuid": "2bc7144f-a81f-47bb-8587-9cfccf8624fd", "content": "CVE-2026-46649: Joplin Server pre-3.7.2 SSO code endpoint skips brute-force limits, letting unauthenticated attackers guess 9-digit codes and steal session tokens for full note access. CVSS 9.1. Patch under review - restrict https://www.valtersit.com/cve/CVE-2026-46649/ #CVE #infosec #Joplin", "url": "https://mastodon.social/users/hugovalters/statuses/117417718754891227"}]}