{"metadata": {"vulnerability": "CVE-2026-59074", "count": 15, "kinds": {"milestone": 3, "sighting": 7, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-07-02T08:57:58.309Z", "date_only": false, "value": "2026-07-02T08:57:58.309Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-59074", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T09:54:00Z", "date_only": false, "value": "2026-11-12T09:54:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-59074", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T03:55:00Z", "date_only": false, "value": "2026-11-13T03:55:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cert.pl/en/posts/2026/11/CVE-2026-59074", "record": "CVE-2026-59074", "field": "creation_timestamp", "uuid": "d6b72d1c-afe0-414b-9508-837b4878a78f", "url": "https://cert.pl/en/posts/2026/11/CVE-2026-59074"}, {"timestamp": "2026-11-13T07:26:21.814Z", "date_only": false, "value": "2026-11-13T07:26:21.814Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59074", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T07:26:21.814Z", "date_only": false, "value": "2026-11-13T07:26:21.814Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-59074", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T07:26:21.814Z", "date_only": false, "value": "2026-11-13T07:26:21.814Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-59074", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T07:33:01.927Z", "date_only": false, "value": "2026-11-13T07:33:01.927887Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117607968361451509", "record": "CVE-2026-59074", "field": "creation_timestamp", "uuid": "287690ef-374b-40d5-9c63-ee61ca5c97cd", "content": "CVE-2026-59074 Improper Cryptographic Signature Verification in Edito CMS Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted\u200b \u200bJWT\u200b containing\u200b \u200ban existing user\u200b \u200bidentifier and, due to the lack of signature validation,\u200b\u200b  obtain\u200b \u200ba \u200b\u200bvalid,\u200b\u200b fully-signed\u200b\u200b session \u200b\u200btoken\u200b\u200b for\u200b\u200b any \u200b\u200baccount \u200b\u200bin\u200b \u200bthe\u200b \u200bsystem. This allows the attacker to impersonate any user, including administrators.This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59074https://cert.pl/posts/2026/11/CVE-2026-59074https://www.edito.pl/#edito #Edito #EditoCMS#CVE_2026_59074#bot", "url": "https://infosec.exchange/users/cve/statuses/117607968361451509"}, {"timestamp": "2026-11-13T07:33:42.429Z", "date_only": false, "value": "2026-11-13T07:33:42.429455Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117607971011088833", "record": "CVE-2026-59074", "field": "creation_timestamp", "uuid": "18cdf48d-9a98-40ad-bdbb-57e392786970", "content": "CVE-2026-59075 Dynamic LINQ Injection in Edito CMS Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59075https://cert.pl/posts/2026/11/CVE-2026-59074https://www.edito.pl/#edito #Edito #EditoCMS#CVE_2026_59075#bot", "url": "https://infosec.exchange/users/cve/statuses/117607971011088833"}, {"timestamp": "2026-11-13T07:34:22.775Z", "date_only": false, "value": "2026-11-13T07:34:22.775491Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117607973658135207", "record": "CVE-2026-59074", "field": "creation_timestamp", "uuid": "def421b7-764a-415c-9ae4-3954b22acfc4", "content": "CVE-2026-59076 Stored XSS in Edito CMS Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59076https://cert.pl/posts/2026/11/CVE-2026-59074https://www.edito.pl/#edito #Edito #EditoCMS#CVE_2026_59076#bot", "url": "https://infosec.exchange/users/cve/statuses/117607973658135207"}, {"timestamp": "2026-11-13T07:35:03.275Z", "date_only": false, "value": "2026-11-13T07:35:03.275071Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117607976308540778", "record": "CVE-2026-59074", "field": "creation_timestamp", "uuid": "8e73628c-32a2-435a-a894-e2edaa6ace7b", "content": "CVE-2026-59077 Stored XSS in Edito CMS Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59077https://cert.pl/posts/2026/11/CVE-2026-59074https://www.edito.pl/#edito #Edito #EditoCMS#CVE_2026_59077#bot", "url": "https://infosec.exchange/users/cve/statuses/117607976308540778"}, {"timestamp": "2026-11-13T07:35:43.716Z", "date_only": false, "value": "2026-11-13T07:35:43.716388Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117607978962067151", "record": "CVE-2026-59074", "field": "creation_timestamp", "uuid": "e178a015-af31-4ba6-b8f1-e7b43d6e0e4f", "content": "CVE-2026-59078 Stored XSS in Edito CMS Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59078https://cert.pl/posts/2026/11/CVE-2026-59074https://www.edito.pl/#edito #Edito #EditoCMS#CVE_2026_59078#bot", "url": "https://infosec.exchange/users/cve/statuses/117607978962067151"}, {"timestamp": "2026-11-13T07:40:24.861Z", "date_only": false, "value": "2026-11-13T07:40:24.861793Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117607997395936934", "record": "CVE-2026-59074", "field": "creation_timestamp", "uuid": "89edca8c-36f7-4e19-b0e7-8ddf3e2ae4a1", "content": "CVE-2026-59079 Unrestricted File Upload in Edito CMS Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction.This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59079https://cert.pl/posts/2026/11/CVE-2026-59074https://www.edito.pl/#edito #Edito #EditoCMS#CVE_2026_59079#bot", "url": "https://infosec.exchange/users/cve/statuses/117607997395936934"}, {"timestamp": "2026-11-13T08:17:17Z", "date_only": false, "value": "2026-11-13T08:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XMV6-5M9X-R9M4", "record": "GHSA-XMV6-5M9X-R9M4", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T09:31:44Z", "date_only": false, "value": "2026-11-13T09:31:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XMV6-5M9X-R9M4", "record": "GHSA-XMV6-5M9X-R9M4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T09:31:44Z", "date_only": false, "value": "2026-11-13T09:31:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XMV6-5M9X-R9M4", "record": "GHSA-XMV6-5M9X-R9M4", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T14:49:25.896Z", "anchors": {"origin": {"timestamp": "2026-11-12T09:54:00Z", "date_only": false, "value": "2026-11-12T09:54:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-59074", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T09:54:00Z", "date_only": false, "value": "2026-11-12T09:54:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-59074", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 104125.896956, "hours": 28.923860265555554, "days": 1.205160844398148, "min_seconds": 104125.896956, "max_seconds": 104125.896956, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T09:54:00Z", "date_only": false, "value": "2026-11-12T09:54:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-59074", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T14:49:25.896Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}