{"metadata": {"vulnerability": "CVE-2026-47428", "count": 27, "kinds": {"milestone": 6, "sighting": 3, "kev": 0, "other": 18}}, "data": [{"timestamp": "2026-05-19T09:23:47Z", "date_only": false, "value": "2026-05-19T09:23:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "record": "CVE-2026-47428", "field": "creation_timestamp", "uuid": "ccb65112-df79-4ed6-bf58-1170de762898", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-05-19T19:37:43.527Z", "date_only": false, "value": "2026-05-19T19:37:43.527Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-47428", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-01T14:12:18Z", "date_only": false, "value": "2026-06-01T14:12:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2H32-95RG-CPPP", "record": "GHSA-2H32-95RG-CPPP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-01T14:12:18Z", "date_only": false, "value": "2026-06-01T14:12:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2H32-95RG-CPPP", "record": "GHSA-2H32-95RG-CPPP", "field": "modified"}, {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T19:28:08.688Z", "date_only": false, "value": "2026-07-14T19:28:08.688000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-07-14T19:30:19.670Z", "date_only": false, "value": "2026-07-14T19:30:19.670Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-47428", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T19:30:19.670Z", "date_only": false, "value": "2026-07-14T19:30:19.670000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T19:30:19.670Z", "date_only": false, "value": "2026-07-14T19:30:19.670Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-47428", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-14T20:03:20.665Z", "date_only": false, "value": "2026-07-14T20:03:20.665764+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-07-14T20:03:51.551Z", "date_only": false, "value": "2026-07-14T20:03:51.551433+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T20:17:02.307Z", "date_only": false, "value": "2026-07-14T20:17:02.307", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47428", "record": "FKIE_CVE-2026-47428", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-15T13:20:10.196Z", "date_only": false, "value": "2026-07-15T13:20:10.196813Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-47428", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-15T13:20:10.196Z", "date_only": false, "value": "2026-07-15T13:20:10.196813Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47428", "record": "FKIE_CVE-2026-47428", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-15T13:20:14.275Z", "date_only": false, "value": "2026-07-15T13:20:14.275Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-47428", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-15T13:20:14.275Z", "date_only": false, "value": "2026-07-15T13:20:14.275Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-47428", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-15T13:38:04.946Z", "date_only": false, "value": "2026-07-15T13:38:04.946277Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqotrh5lhp2u", "record": "CVE-2026-47428", "field": "creation_timestamp", "uuid": "d36e2be9-5539-421e-9b15-a779cd2bb4b4", "content": "CVE-2026-47428 - browser\nVitest's browser mode can execute malicious JavaScript if you visit a specially crafted URL. This could allow an attacker to steal your Vitest API token and use it to access your\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#browser #vitest #npm #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqotrh5lhp2u"}, {"timestamp": "2026-08-20T14:04:49.300Z", "date_only": false, "value": "2026-08-20T14:04:49.300875Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/whatsnew.fyi/post/3mtjg2f7rwx2t", "record": "CVE-2026-47428", "field": "creation_timestamp", "uuid": "ebe817be-4565-4655-8e97-6081715d3406", "content": "Storybook v10.5.10\n\nBump Vitest to 4.1.6 (CVE-2026-47428)", "url": "https://bsky.app/profile/whatsnew.fyi/post/3mtjg2f7rwx2t"}, {"timestamp": "2026-09-04T00:36:24Z", "date_only": false, "value": "2026-09-04T00:36:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-08T00:10:46Z", "date_only": false, "value": "2026-09-08T00:10:46+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-08T00:10:46Z", "date_only": false, "value": "2026-09-08T00:10:46+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-08T00:10:46Z", "date_only": false, "value": "2026-09-08T00:10:46+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T07:57:00Z", "date_only": false, "value": "2026-10-16T07:57:00Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-UG94602", "record": "CLEANSTART-2026-UG94602", "field": "modified"}, {"timestamp": "2026-10-24T21:10:00.130Z", "date_only": false, "value": "2026-10-24T21:10:00.130", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47428", "record": "FKIE_CVE-2026-47428", "field": "lastModified"}, {"timestamp": "2026-10-30T10:11:16.663Z", "date_only": false, "value": "2026-10-30T10:11:16.663440Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-UG94602", "record": "CLEANSTART-2026-UG94602", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}], "metrics": {"as_of": "2026-10-31T21:19:38.613Z", "anchors": {"origin": {"timestamp": "2026-07-14T20:03:51.551Z", "date_only": false, "value": "2026-07-14T20:03:51.551433+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "discovery": {"timestamp": "2026-07-14T20:03:51.551Z", "date_only": false, "value": "2026-07-14T20:03:51.551433+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-01T14:12:18Z", "date_only": false, "value": "2026-06-01T14:12:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2H32-95RG-CPPP", "record": "GHSA-2H32-95RG-CPPP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-05-19T09:23:47Z", "date_only": false, "value": "2026-05-19T09:23:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "record": "CVE-2026-47428", "field": "creation_timestamp", "uuid": "ccb65112-df79-4ed6-bf58-1170de762898", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -1140511.0, "hours": -316.80861111111113, "days": -13.200358796296296, "min_seconds": -1140511.0, "max_seconds": -1140511.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-06-01T14:12:18Z", "date_only": false, "value": "2026-06-01T14:12:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2H32-95RG-CPPP", "record": "GHSA-2H32-95RG-CPPP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-05-19T09:23:47Z", "date_only": false, "value": "2026-05-19T09:23:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "record": "CVE-2026-47428", "field": "creation_timestamp", "uuid": "ccb65112-df79-4ed6-bf58-1170de762898", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": -73262.551, "hours": -20.350708611111113, "days": -0.8479461921296297, "min_seconds": -73262.551, "max_seconds": -73262.551, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-07-14T20:03:51.551Z", "date_only": false, "value": "2026-07-14T20:03:51.551433+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "disclosure_to_patch": {"available": true, "seconds": 3663031.0, "hours": 1017.5086111111111, "days": 42.39619212962963, "min_seconds": 3663031.0, "max_seconds": 3663031.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-01T14:12:18Z", "date_only": false, "value": "2026-06-01T14:12:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2H32-95RG-CPPP", "record": "GHSA-2H32-95RG-CPPP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-07-14T20:03:51.551Z", "date_only": false, "value": "2026-07-14T20:03:51.551433+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 4803542.0, "hours": 1334.3172222222222, "days": 55.596550925925925, "min_seconds": 4803542.0, "max_seconds": 4803542.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-19T09:23:47Z", "date_only": false, "value": "2026-05-19T09:23:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "record": "CVE-2026-47428", "field": "creation_timestamp", "uuid": "ccb65112-df79-4ed6-bf58-1170de762898", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}}}