{"metadata": {"vulnerability": "CVE-2026-58400", "count": 27, "kinds": {"milestone": 4, "sighting": 10, "kev": 4, "other": 9}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0343", "record": "NCSC-2026-0343", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-30T18:19:58.378Z", "date_only": false, "value": "2026-06-30T18:19:58.378Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-58400", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-02T00:00:00Z", "date_only": false, "value": "2026-09-02T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "enisa-cnw-kev", "record": "CVE-2026-58400", "field": "timestamps.asserted_at", "uuid": "6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-02T00:00:00Z", "date_only": false, "value": "2026-09-02T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "enisa-cnw-kev", "record": "CVE-2026-58400", "field": "timestamps.first_seen_at", "uuid": "6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-02T00:00:00Z", "date_only": false, "value": "2026-09-02T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "enisa-cnw-kev", "record": "CVE-2026-58400", "field": "status.status_updated_at", "uuid": "6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-03T12:28:54.061Z", "date_only": false, "value": "2026-09-03T12:28:54.061853Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/d3a9a3be-7e46-44d6-a018-982d32551a2a", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "75a6230e-27dd-46f4-9a42-a1a62ea30172", "url": "https://vulnerability.circl.lu/bundle/d3a9a3be-7e46-44d6-a018-982d32551a2a"}, {"timestamp": "2026-09-03T17:06:17.827Z", "date_only": false, "value": "2026-09-03T17:06:17.827Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58400", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-03T17:06:17.827Z", "date_only": false, "value": "2026-09-03T17:06:17.827Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-58400", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-03T17:49:43.605Z", "date_only": false, "value": "2026-09-03T17:49:43.605439Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58400", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-03T17:49:43.605Z", "date_only": false, "value": "2026-09-03T17:49:43.605439Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58400", "record": "FKIE_CVE-2026-58400", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-03T18:17:22.827Z", "date_only": false, "value": "2026-09-03T18:17:22.827", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58400", "record": "FKIE_CVE-2026-58400", "field": "published"}, {"timestamp": "2026-09-03T19:00:54.052Z", "date_only": false, "value": "2026-09-03T19:00:54.052403Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mun54p72iz2v", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "ebafaa34-db4f-4f74-a72f-e85f60efd17a", "content": "\ud83d\udd34 CVE-2026-58400 - Critical (9.1)\n\nGeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-58400/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mun54p72iz2v"}, {"timestamp": "2026-09-03T19:02:33.370Z", "date_only": false, "value": "2026-09-03T19:02:33.370310Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bhtdpnkypdqs4", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "4df7fde5-66e4-4972-931d-b755574fcc79", "content": "CVE-2026-58400 - GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter\nCVE ID : CVE-2026-58400\n \n Published : Sept. 3, 2026, 6:17 p.m. | 20\u00a0minutes ago\n \n Description : GeoNetwork is a catalog application to manage spatially ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/bhtdpnkypdqs4"}, {"timestamp": "2026-09-03T19:20:04.359Z", "date_only": false, "value": "2026-09-03T19:20:04.359932Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mun66z33rp22", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "bf8ce4cc-9922-4751-822c-99d2c094d6d9", "content": "CVE-2026-58400 - core-geonetwork\nOlder versions of GeoNetwork let a user who can upload a formatting file add code that runs any command on the server. This could let an attacker take control of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#coregeonetwork #geonetwork #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mun66z33rp22"}, {"timestamp": "2026-09-04T07:00:01Z", "date_only": false, "value": "2026-09-04T07:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "enisa-cnw-kev", "record": "CVE-2026-58400", "field": "timestamps.recorded_at", "uuid": "6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-04T07:00:01.574Z", "date_only": false, "value": "2026-09-04T07:00:01.574199Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "6b6eb94a-4a7a-46ac-a57f-d3cdb3d48725", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6cbe7f45-6ec1-4ccf-a3fb-f7c2c79d294c"}, {"timestamp": "2026-09-04T13:42:08.271Z", "date_only": false, "value": "2026-09-04T13:42:08.271Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-58400", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-04T13:42:08.271Z", "date_only": false, "value": "2026-09-04T13:42:08.271Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58400", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-04T18:00:04.450Z", "date_only": false, "value": "2026-09-04T18:00:04.450587Z", "kind": "sighting", "label": "Seen", "source": "Telegram/9h73ajeEnWq1UUc99NXcO070Q77AwRDt_XFlqiCagLlKFUc", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "f0522e8f-3237-4f08-8dc4-42ab907f6c06"}, {"timestamp": "2026-09-05T01:00:19.857Z", "date_only": false, "value": "2026-09-05T01:00:19.857408Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/9h73ajeEnWq1UUc99NXcO070Q77AwRDt_XFlqiCagLlKFUc", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "f25e94d9-2653-4a90-b931-9043e5ef711f"}, {"timestamp": "2026-09-06T23:32:56.048Z", "date_only": false, "value": "2026-09-06T23:32:56.048411Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muv5psuuec26", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "e25fe528-d663-48a2-b65c-fa4cfbf7a308", "content": "\ud83d\udd34 GeoNetwork unauthenticated RCE chain\n\nCVE-2026-63219 + CVE-2026-58400 can be chained to achieve pre-auth remote code execution in vulnerable GeoNetwork servers. Researchers found \n\nstemshop.top/blog/geonetw...\n\n#CVE #CVE202663219 #CVE202658400 #GeoNetwork #RCE #GeoSecurity #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3muv5psuuec26"}, {"timestamp": "2026-09-07T00:40:51.305Z", "date_only": false, "value": "2026-09-07T00:40:51.305450Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3muvbjesqo62r", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "9156c6f9-38d0-471b-b1e4-3071a4b974ad", "content": "GeoNetwork Falls To Pre-Auth RCE While Bureaucrats Worship Their Stamps\nPANIC 76% | Lag 0.0h | GeoNetwork servers vulnerable to the CVE-2026-63219 and CVE-2026-58400 chain can be compromised befo\n#AfterShockIndex\nREAD MORE", "url": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3muvbjesqo62r"}, {"timestamp": "2026-09-07T12:00:00.558Z", "date_only": false, "value": "2026-09-07T12:00:00.558124Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0343", "record": "NCSC-2026-0343", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-07T12:00:00.558Z", "date_only": false, "value": "2026-09-07T12:00:00.558124Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0343", "record": "NCSC-2026-0343", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-07T12:00:00.558Z", "date_only": false, "value": "2026-09-07T12:00:00.558124Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0343", "record": "NCSC-2026-0343", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-09T21:09:13.080Z", "date_only": false, "value": "2026-09-09T21:09:13.080", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58400", "record": "FKIE_CVE-2026-58400", "field": "lastModified"}, {"timestamp": "2026-10-01T10:02:30.697Z", "date_only": false, "value": "2026-10-01T10:02:30.697064Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0xacb.com/post/3mwsm3rttkr2c", "record": "CVE-2026-58400", "field": "creation_timestamp", "uuid": "5387f9cc-c424-403e-9384-381bf67eccd0", "content": "CVE-2026-63219 - Unauthenticated file upload via missing Authorization on formatter Upload Endpoint\nCVE-2026-55864 - Unauthenticated Server-Side Request Forgery in SLD Tool\nCVE-2026-57582 - Reflected XSS via unsanitized Javascript Sink\nCVE-2026-58400 - Remote Code Execution via unsafe Saxon XSLT", "url": "https://bsky.app/profile/0xacb.com/post/3mwsm3rttkr2c"}]}