{"metadata": {"vulnerability": "CVE-2026-59188", "count": 7, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-07-02T19:53:48.830Z", "date_only": false, "value": "2026-07-02T19:53:48.830Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-59188", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T03:59:11.068Z", "date_only": false, "value": "2026-10-23T03:59:11.068Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59188", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-23T03:59:11.068Z", "date_only": false, "value": "2026-10-23T03:59:11.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-59188", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T03:59:11.068Z", "date_only": false, "value": "2026-10-23T03:59:11.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-59188", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T04:21:11.516Z", "date_only": false, "value": "2026-10-23T04:21:11.516798Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117488305446977539", "record": "CVE-2026-59188", "field": "creation_timestamp", "uuid": "e96fce22-9903-4917-a835-b34ffcb7f8c9", "content": "CVE-2026-59188 Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59188https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-2vhp-c958-m47jhttps://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.3#Part-DB #Part-DB-server#CVE_2026_59188#bot", "url": "https://infosec.exchange/users/cve/statuses/117488305446977539"}, {"timestamp": "2026-10-23T05:17:17.937Z", "date_only": false, "value": "2026-10-23T05:17:17.937", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59188", "record": "FKIE_CVE-2026-59188", "field": "published"}, {"timestamp": "2026-10-23T19:36:32.410Z", "date_only": false, "value": "2026-10-23T19:36:32.410", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59188", "record": "FKIE_CVE-2026-59188", "field": "lastModified"}]}