{"metadata": {"vulnerability": "CVE-2026-51886", "count": 25, "kinds": {"milestone": 6, "sighting": 3, "kev": 5, "other": 11}}, "data": [{"timestamp": "2026-06-08T00:00:00Z", "date_only": false, "value": "2026-06-08T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-26T04:04:49Z", "date_only": false, "value": "2026-09-26T04:04:49.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a", "record": "CVE-2026-51886", "field": "creation_timestamp", "uuid": "fad76c23-a07f-4bc3-bc70-f73572e9b569", "content": "# CVE-2026-51886\n\n**Type:** Code Injection\n**Product:** langflow\n**Affected versions:** \u22641.9.3\n**Affected component:** `src/backend/base/langflow/api/v1/validate.py:post_validate_code`\n**Reference:** https://github.com/langflow-ai/langflow/issues/13336\n\n## Description\n\nA weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.\n\n## Discoverer\n\nRo1ME\n", "url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"}, {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-01T21:37:18.387Z", "date_only": false, "value": "2026-10-01T21:37:18.387Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2026-51886", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-01T22:17:03Z", "date_only": false, "value": "2026-10-01T22:17:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QQW9-2VJ9-HX7R", "record": "GHSA-QQW9-2VJ9-HX7R", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-01T22:17:03.387Z", "date_only": false, "value": "2026-10-01T22:17:03.387", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-51886", "record": "FKIE_CVE-2026-51886", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-02T00:31:30Z", "date_only": false, "value": "2026-10-02T00:31:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QQW9-2VJ9-HX7R", "record": "GHSA-QQW9-2VJ9-HX7R", "field": "published"}, {"timestamp": "2026-10-05T22:30:52Z", "date_only": false, "value": "2026-10-05T22:30:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QQW9-2VJ9-HX7R", "record": "GHSA-QQW9-2VJ9-HX7R", "field": "modified"}, {"timestamp": "2026-10-05T22:30:52Z", "date_only": false, "value": "2026-10-05T22:30:52Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-QQW9-2VJ9-HX7R", "record": "GHSA-QQW9-2VJ9-HX7R", "field": "withdrawn"}, {"timestamp": "2026-10-05T22:31:00Z", "date_only": false, "value": "2026-10-05T22:31:00Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W584-2H2R-2HVF", "record": "GHSA-W584-2H2R-2HVF", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-05T22:31:00Z", "date_only": false, "value": "2026-10-05T22:31:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "record": "CVE-2026-51886", "field": "creation_timestamp", "uuid": "4dc79281-5d5f-49b3-99d7-d77068c31031", "url": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-05T22:31:00Z", "date_only": false, "value": "2026-10-05T22:31:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W584-2H2R-2HVF", "record": "GHSA-W584-2H2R-2HVF", "field": "modified"}, {"timestamp": "2026-10-05T23:56:06.740Z", "date_only": false, "value": "2026-10-05T23:56:06.740367Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-51886", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-05T23:56:06.740Z", "date_only": false, "value": "2026-10-05T23:56:06.740367Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-51886", "record": "FKIE_CVE-2026-51886", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-05T23:56:49.602Z", "date_only": false, "value": "2026-10-05T23:56:49.602Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-05T23:56:49.602Z", "date_only": false, "value": "2026-10-05T23:56:49.602Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-51886", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-06T01:16:36.093Z", "date_only": false, "value": "2026-10-06T01:16:36.093", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-51886", "record": "FKIE_CVE-2026-51886", "field": "lastModified"}, {"timestamp": "2026-10-06T10:31:37Z", "date_only": false, "value": "2026-10-06T10:31:37+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-51886", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-06T10:31:37Z", "date_only": false, "value": "2026-10-06T10:31:37+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-51886", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-06T10:31:37Z", "date_only": false, "value": "2026-10-06T10:31:37+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-51886", "field": "status.status_updated_at", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-06T10:31:37.276Z", "date_only": false, "value": "2026-10-06T10:31:37.276Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-51886", "field": "evidence.0.details.added_date", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-07T11:00:01Z", "date_only": false, "value": "2026-10-07T11:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-51886", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-07T11:01:28.352Z", "date_only": false, "value": "2026-10-07T11:01:28.352945Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "record": "CVE-2026-51886", "field": "creation_timestamp", "uuid": "33232f01-dcb5-4980-9d35-c5d53cb3e729", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-15T10:22:44.141Z", "date_only": false, "value": "2026-10-15T10:22:44.141747Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4236", "record": "PYSEC-2026-4236", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-15T14:37:45.436Z", "date_only": false, "value": "2026-10-15T14:37:45.436338Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4236", "record": "PYSEC-2026-4236", "field": "modified"}], "metrics": {"as_of": "2026-10-29T02:16:55.170Z", "anchors": {"origin": {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-05T22:31:00Z", "date_only": false, "value": "2026-10-05T22:31:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "record": "CVE-2026-51886", "field": "creation_timestamp", "uuid": "4dc79281-5d5f-49b3-99d7-d77068c31031", "url": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-10-06T10:31:37Z", "date_only": false, "value": "2026-10-06T10:31:37+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-51886", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 469897.0, "hours": 130.52694444444444, "days": 5.4386226851851855, "min_seconds": 383497.0, "max_seconds": 469897.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-06T10:31:37Z", "date_only": false, "value": "2026-10-06T10:31:37+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-51886", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 469897.0, "hours": 130.52694444444444, "days": 5.4386226851851855, "min_seconds": 383497.0, "max_seconds": 469897.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-06T10:31:37Z", "date_only": false, "value": "2026-10-06T10:31:37+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-51886", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 426660.0, "hours": 118.51666666666667, "days": 4.938194444444444, "min_seconds": 340260.0, "max_seconds": 426660.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-05T22:31:00Z", "date_only": false, "value": "2026-10-05T22:31:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "record": "CVE-2026-51886", "field": "creation_timestamp", "uuid": "4dc79281-5d5f-49b3-99d7-d77068c31031", "url": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2427415.17018, "hours": 674.2819917166667, "days": 28.095082988194445, "min_seconds": 2341015.17018, "max_seconds": 2427415.17018, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-51886", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T02:16:55.170Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 1957518.17018, "hours": 543.7550472722222, "days": 22.656460303009258, "min_seconds": 1957518.17018, "max_seconds": 1957518.17018, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-06T10:31:37Z", "date_only": false, "value": "2026-10-06T10:31:37+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-51886", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "3705cd39-ccb9-41e1-b34c-ad0c8aabf03b", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-10-29T02:16:55.170Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 2000755.17018, "hours": 555.76532505, "days": 23.15688854375, "min_seconds": 2000755.17018, "max_seconds": 2000755.17018, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-05T22:31:00Z", "date_only": false, "value": "2026-10-05T22:31:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "record": "CVE-2026-51886", "field": "creation_timestamp", "uuid": "4dc79281-5d5f-49b3-99d7-d77068c31031", "url": "https://github.com/advisories/GHSA-w584-2h2r-2hvf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T02:16:55.170Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}