{"metadata": {"vulnerability": "CVE-2026-52891", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-06-08T21:44:27.365Z", "date_only": false, "value": "2026-06-08T21:44:27.365Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-52891", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-15T21:08:02.223Z", "date_only": false, "value": "2026-07-15T21:08:02.223Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-52891", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-15T21:08:02.223Z", "date_only": false, "value": "2026-07-15T21:08:02.223Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-52891", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-15T22:06:04.313Z", "date_only": false, "value": "2026-07-15T22:06:04.313239Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpq5spsbr25", "record": "CVE-2026-52891", "field": "creation_timestamp", "uuid": "d9b24df5-b0bc-434e-b83f-41d64a088c0c", "content": "CVE-2026-52891 - wekan\nWekan, an open source project management tool, allows attackers to execute commands on the server by uploading a malicious avatar with special characters. This can lead to unauthorized access and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wekan #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpq5spsbr25"}, {"timestamp": "2026-07-15T22:17:16.450Z", "date_only": false, "value": "2026-07-15T22:17:16.450", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52891", "record": "FKIE_CVE-2026-52891", "field": "published"}, {"timestamp": "2026-07-16T00:30:46.914Z", "date_only": false, "value": "2026-07-16T00:30:46.914649Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyal2izp2s", "record": "CVE-2026-52891", "field": "creation_timestamp", "uuid": "534b1c66-1e5d-466c-97ee-b40d87f6fa54", "content": "CVE-2026-52891 - Wekan: Shell Injection via Avatar Upload\nCVE ID : CVE-2026-52891\n \n Published : July 15, 2026, 10:17 p.m. | 17\u00a0minutes ago\n \n Description : Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied fil...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyal2izp2s"}, {"timestamp": "2026-07-17T18:23:06.206Z", "date_only": false, "value": "2026-07-17T18:23:06.206379Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-52891", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-17T18:23:06.206Z", "date_only": false, "value": "2026-07-17T18:23:06.206379Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52891", "record": "FKIE_CVE-2026-52891", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-17T18:23:51.039Z", "date_only": false, "value": "2026-07-17T18:23:51.039Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-52891", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-17T18:23:51.039Z", "date_only": false, "value": "2026-07-17T18:23:51.039Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-52891", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-17T19:17:16.647Z", "date_only": false, "value": "2026-07-17T19:17:16.647", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52891", "record": "FKIE_CVE-2026-52891", "field": "lastModified"}, {"timestamp": "2026-07-18T04:18:04.274Z", "date_only": false, "value": "2026-07-18T04:18:04.274959Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqvfutk4u62a", "record": "CVE-2026-52891", "field": "creation_timestamp", "uuid": "540e8a17-e2ed-454c-90e7-db69cce3f290", "content": "CVE-2026-52891\nWekan's avatar upload feature allows hackers to execute server commands if they upload a file with malicious characters. This is a security risk because it could allow hackers to take control of your server. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqvfutk4u62a"}]}