{"metadata": {"vulnerability": "CVE-2026-63429", "count": 13, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-07-16T19:35:57.766Z", "date_only": false, "value": "2026-07-16T19:35:57.766Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63429", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-20T15:54:22.075Z", "date_only": false, "value": "2026-07-20T15:54:22.075Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63429", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-20T15:54:22.075Z", "date_only": false, "value": "2026-07-20T15:54:22.075Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-63429", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-20T16:17:06.810Z", "date_only": false, "value": "2026-07-20T16:17:06.810", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63429", "record": "FKIE_CVE-2026-63429", "field": "published"}, {"timestamp": "2026-07-20T17:00:33.714Z", "date_only": false, "value": "2026-07-20T17:00:33.714332Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3rg45qoq2j", "record": "CVE-2026-63429", "field": "creation_timestamp", "uuid": "85bf0a3b-20ce-4879-81c3-9246be0edadf", "content": "\ud83d\udfe0 CVE-2026-63429 - High (8.6)\n\nHeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no au...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63429/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3rg45qoq2j"}, {"timestamp": "2026-07-20T17:11:49.043Z", "date_only": false, "value": "2026-07-20T17:11:49.043354Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mr3s2aonz52z", "record": "CVE-2026-63429", "field": "creation_timestamp", "uuid": "f4ec0e5b-e561-4db6-b6b0-1aefccd6fab9", "content": "CVE-2026-63429 - Critical auth bypass in Heyform open-source form builder. Anonymous users can upload files up to 10MB to a public URL with no authentication checks. CVSS 8.6. No patch yet - restrict access immediately. #CVE #Heyform #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-63429/", "url": "https://bsky.app/profile/hugovalters.bsky.social/post/3mr3s2aonz52z"}, {"timestamp": "2026-07-20T17:11:49.339Z", "date_only": false, "value": "2026-07-20T17:11:49.339882Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/116953416257282503", "record": "CVE-2026-63429", "field": "creation_timestamp", "uuid": "cf31724e-7a43-4a7b-afb7-be8c6cfd35d3", "content": "CVE-2026-63429 - Critical auth bypass in Heyform open-source form builder. Anonymous users can upload files up to 10MB to a public URL with no authentication checks. CVSS 8.6. No patch yet - restrict access immediately. #CVE #Heyform #infosec\nhttps://www.valtersit.com/cve/CVE-2026-63429/", "url": "https://mastodon.social/users/hugovalters/statuses/116953416257282503"}, {"timestamp": "2026-07-20T17:43:44.186Z", "date_only": false, "value": "2026-07-20T17:43:44.186669Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3ttbetjd2q", "record": "CVE-2026-63429", "field": "creation_timestamp", "uuid": "62d0d62f-65e0-466d-a05c-91f31e44dfcb", "content": "CVE-2026-63429 - HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context\nCVE ID : CVE-2026-63429\n \n Published : July 20, 2026, 4:17 p.m. | 18\u00a0minutes ago\n \n Description : HeyForm is an open-source form builder. Prior to v...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3ttbetjd2q"}, {"timestamp": "2026-07-20T17:45:12.280Z", "date_only": false, "value": "2026-07-20T17:45:12.280558Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63429", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-20T17:45:12.280Z", "date_only": false, "value": "2026-07-20T17:45:12.280558Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63429", "record": "FKIE_CVE-2026-63429", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-20T17:45:35.044Z", "date_only": false, "value": "2026-07-20T17:45:35.044Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63429", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-20T17:45:35.044Z", "date_only": false, "value": "2026-07-20T17:45:35.044Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63429", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-22T20:50:36.493Z", "date_only": false, "value": "2026-07-22T20:50:36.493", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63429", "record": "FKIE_CVE-2026-63429", "field": "lastModified"}]}