{"metadata": {"vulnerability": "CVE-2026-54618", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-06-15T20:07:02.184Z", "date_only": false, "value": "2026-06-15T20:07:02.184Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-54618", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-17T19:45:15.384Z", "date_only": false, "value": "2026-09-17T19:45:15.384Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54618", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-17T19:45:15.384Z", "date_only": false, "value": "2026-09-17T19:45:15.384Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-54618", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-17T20:16:51.823Z", "date_only": false, "value": "2026-09-17T20:16:51.823", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54618", "record": "FKIE_CVE-2026-54618", "field": "published"}, {"timestamp": "2026-09-17T22:07:40.168Z", "date_only": false, "value": "2026-09-17T22:07:40.168800Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvqo3jzrrg25", "record": "CVE-2026-54618", "field": "creation_timestamp", "uuid": "bc0fdf32-47b3-473d-b873-9fa237d23cd8", "content": "\ud83d\udea8 CVE-2026-54618 \u2014 CVSS 9.4 CRITICAL\n\nObsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-54618\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mvqo3jzrrg25"}, {"timestamp": "2026-09-18T00:02:10.533Z", "date_only": false, "value": "2026-09-18T00:02:10.533783Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/6581c4aa6bcac5d92204c3046949ce64", "record": "CVE-2026-54618", "field": "creation_timestamp", "uuid": "46b2dc58-965c-4637-818b-88e7870ce428", "content": "This cyber threat intelligence briefing highlights critical vulnerabilities, defense frameworks, and emerging security discussions:\n\n**Critical Vulnerabilities & Patches:**\n- **Obsidian Web MCP (CVE-2026-54618, CVSS 9.4):** Allows unauthenticated vault access via flawed OAuth flows; fixed in v0.2.0.\n- **Cisco ISE (CVE-2026-76460, CVSS 10.0):** Actively exploited zero-day granting root access through an unauthenticated API; emergency patches released alongside fixes for 21+ other ISE flaws and related firewall products.\n- **Dell (Advisory AV26-934):** Covers multiple products (Networking OS10, OMSA, ECS, DUP, Wyse, DRM); administrators are urged to apply updates promptly.\n\n**Infrastructure & Policy:**\n- A new framework standardizes Kubernetes admission control and supply chain verification in air-gapped environments using DSSE-signed evidence, policy-based filtering, and zero-telemetry data retention for compliance reporting.\n\n**Community & Analysis:**\n- Featured discussions cover state-led information operations and how AI advancements may soon make personal internet history fully attributable.\n\n**Bottom Line:** Immediate patching is critical for Obsidian, Cisco, and Dell systems, while organizations are exploring stricter, air-gapped K8s security policies and monitoring the broader implications of AI and state information campaigns.", "url": "https://gist.github.com/ichintu/6581c4aa6bcac5d92204c3046949ce64"}, {"timestamp": "2026-09-18T00:50:07.853Z", "date_only": false, "value": "2026-09-18T00:50:07.853213Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvqx63tmuz2r", "record": "CVE-2026-54618", "field": "creation_timestamp", "uuid": "669718be-d6cc-48eb-a0d3-c98d3d0b360e", "content": "CVE-2026-54618 - obsidian-web-mcp\nVersions of Obsidian Web MCP before 0.2.0 let a remote user obtain a code that can be exchanged for a fixed secret, bypassing any login or permission check. With that secret the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jimprosser #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mvqx63tmuz2r"}, {"timestamp": "2026-09-24T20:40:24.993Z", "date_only": false, "value": "2026-09-24T20:40:24.993933Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54618", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-24T20:40:24.993Z", "date_only": false, "value": "2026-09-24T20:40:24.993933Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54618", "record": "FKIE_CVE-2026-54618", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-24T20:40:37.956Z", "date_only": false, "value": "2026-09-24T20:40:37.956Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-54618", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-24T20:40:37.956Z", "date_only": false, "value": "2026-09-24T20:40:37.956Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54618", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-30T17:32:07.107Z", "date_only": false, "value": "2026-09-30T17:32:07.107", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54618", "record": "FKIE_CVE-2026-54618", "field": "lastModified"}]}