{"metadata": {"vulnerability": "CVE-2026-48168", "count": 13, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-05-20T23:12:43.032Z", "date_only": false, "value": "2026-05-20T23:12:43.032Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-48168", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-05T18:29:38.632Z", "date_only": false, "value": "2026-08-05T18:29:38.632Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-48168", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-05T18:29:38.632Z", "date_only": false, "value": "2026-08-05T18:29:38.632Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-48168", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-05T19:17:31.070Z", "date_only": false, "value": "2026-08-05T19:17:31.070", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48168", "record": "FKIE_CVE-2026-48168", "field": "published"}, {"timestamp": "2026-08-05T19:23:57.492Z", "date_only": false, "value": "2026-08-05T19:23:57.492283Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48168", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-05T19:23:57.492Z", "date_only": false, "value": "2026-08-05T19:23:57.492283Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48168", "record": "FKIE_CVE-2026-48168", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-05T19:24:05.128Z", "date_only": false, "value": "2026-08-05T19:24:05.128Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-48168", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-05T19:24:05.128Z", "date_only": false, "value": "2026-08-05T19:24:05.128Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48168", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-05T20:01:44.465Z", "date_only": false, "value": "2026-08-05T20:01:44.465474Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msecysnw6o2a", "record": "CVE-2026-48168", "field": "creation_timestamp", "uuid": "c0cb533e-788c-4b04-87cd-7f23432f981e", "content": "\ud83d\udd34 CVE-2026-48168 - Critical (10)\n\nPraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub A...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-48168/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msecysnw6o2a"}, {"timestamp": "2026-08-05T20:18:04.610Z", "date_only": false, "value": "2026-08-05T20:18:04.610458Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msedvztdh72a", "record": "CVE-2026-48168", "field": "creation_timestamp", "uuid": "82067b48-86cd-48b8-bd05-b9a137955848", "content": "CVE-2026-48168 - praisonai\nPraisonAI's GitHub Actions workflow is vulnerable to attacks if an unauthorized contributor submits a pull request with malicious branch name and comments '@claude'. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3msedvztdh72a"}, {"timestamp": "2026-08-06T06:00:29.956Z", "date_only": false, "value": "2026-08-06T06:00:29.956986Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msfehhourb2w", "record": "cve-2026-48168", "field": "creation_timestamp", "uuid": "8ee71851-b4a9-425e-9794-052e2171d4cd", "content": "PraisonAI <4.6.40 has a CRITICAL CVE-2026-48168 flaw: attackers can exploit GitHub Actions for command injection, risking repo takeover. Upgrade to 4.6.40 ASAP. https://radar.offseq.com/threat/cve-2026-48168-cwe-862-missing-authorization-in-mervinpraison-praisonai-b6d133d881efd541 #OffSeq #CVE202...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3msfehhourb2w"}, {"timestamp": "2026-08-06T06:00:30.871Z", "date_only": false, "value": "2026-08-06T06:00:30.871490Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117047035642701206", "record": "cve-2026-48168", "field": "creation_timestamp", "uuid": "20dead4a-45ef-47f9-bd7b-5996b6b7e307", "content": "PraisonAI <4.6.40 is affected by CVE-2026-48168 (CRITICAL, CVSS 10): Missing authorization lets attackers exploit GitHub Actions, execute arbitrary shell commands, and compromise repos. Patch to 4.6.40! https://radar.offseq.com/threat/cve-2026-48168-cwe-862-missing-authorization-in-mervinpraison-praisonai-b6d133d881efd541 #OffSeq #CVE202648168 #SecDevOps", "url": "https://infosec.exchange/users/offseq/statuses/117047035642701206"}, {"timestamp": "2026-09-08T20:51:43.490Z", "date_only": false, "value": "2026-09-08T20:51:43.490", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48168", "record": "FKIE_CVE-2026-48168", "field": "lastModified"}]}