{"metadata": {"vulnerability": "CVE-2026-69150", "count": 22, "kinds": {"milestone": 5, "sighting": 4, "kev": 0, "other": 13}}, "data": [{"timestamp": "2026-08-03T15:47:09.654Z", "date_only": false, "value": "2026-08-03T15:47:09.654Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-69150", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T22:00:00Z", "date_only": false, "value": "2026-09-23T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-09-23T22:00:00Z", "date_only": false, "value": "2026-09-23T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-23T22:00:00Z", "date_only": false, "value": "2026-09-23T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T15:23:36.744Z", "date_only": false, "value": "2026-10-13T15:23:36.744Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-69150", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-13T15:23:36.744Z", "date_only": false, "value": "2026-10-13T15:23:36.744Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-69150", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T15:41:35.120Z", "date_only": false, "value": "2026-10-13T15:41:35.120977Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117434357819995177", "record": "CVE-2026-69150", "field": "creation_timestamp", "uuid": "0d1d44da-7bbb-4b23-b0d9-feed6b475bce", "content": "CVE-2026-69150 KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-69150https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4642-49vv-4p43https://github.com/keepassxreboot/keepassxc/commit/6a534f38c61295d60b0e937739a12511e76dbfebhttps://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0-beta1#keepassxreboot #keepassxc#CVE_2026_69150#bot", "url": "https://infosec.exchange/users/cve/statuses/117434357819995177"}, {"timestamp": "2026-10-13T16:17:00Z", "date_only": false, "value": "2026-10-13T16:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-69150", "record": "UBUNTU-CVE-2026-69150", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T16:17:00Z", "date_only": false, "value": "2026-10-13T16:17:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-69150", "record": "UBUNTU-CVE-2026-69150", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-13T16:17:22.327Z", "date_only": false, "value": "2026-10-13T16:17:22.327", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69150", "record": "FKIE_CVE-2026-69150", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T20:13:10.362Z", "date_only": false, "value": "2026-10-13T20:13:10.362463Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-69150", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T20:13:10.362Z", "date_only": false, "value": "2026-10-13T20:13:10.362463Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69150", "record": "FKIE_CVE-2026-69150", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-13T20:22:44.545Z", "date_only": false, "value": "2026-10-13T20:22:44.545Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-69150", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T20:22:44.545Z", "date_only": false, "value": "2026-10-13T20:22:44.545Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-69150", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-16T20:02:37.630Z", "date_only": false, "value": "2026-10-16T20:02:37.630", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69150", "record": "FKIE_CVE-2026-69150", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-17T08:37:58.270Z", "date_only": false, "value": "2026-10-17T08:37:58.270622Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3my2ote2ase2f", "record": "CVE-2026-69150", "field": "creation_timestamp", "uuid": "dd2fd930-9561-44b3-bb57-ad0e9e1ca5b3", "content": "keepassxc: fix CVE-2026-69150\n\nhttps://github.com/NixOS/nixpkgs/pull/575169\n\nhttps://tracker.security.nixos.org/issues/NIXPKGS-2026-3026\n\n#security", "url": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3my2ote2ase2f"}, {"timestamp": "2026-10-26T00:29:03.620Z", "date_only": false, "value": "2026-10-26T00:29:03.620873Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117504379639061841", "record": "CVE-2026-69150", "field": "creation_timestamp", "uuid": "0d334502-ef14-42ed-af00-4b396968cd44", "content": "\ud83d\udea8 KeePassXC 2.8.0 is out with several security fixes and a major move to Qt 6\nRelease: https://github.com/keepassxreboot/keepassxc/releases\nhttps://keepassxc.org/download\nThe update fixes CVE-2026-69150, a use-after-free triggered when importing a crafted legacy KDB file, along with multiple additional browser integration, memory safety, and Windows security issues that are still awaiting CVE assignments.\nSecurity fixes include:\n\u2022 Crafted KDB import use-after-free\u2022 Browser entry reference injection\u2022 Out-of-bounds writes in native messaging\u2022 Weak Pageant shared-memory mapping names on Windows\u2022 Integer overflow and out-of-bounds read in the legacy KDB importer\u2022 Improved clearing of decrypted database fragments from memory\nKeePassXC 2.8.0 also adds remote database synchronization, configurable shortcuts, SSH key generation, Wayland Auto-Type support, Linux Quick Unlock, and native Windows Arm64 builds.", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117504379639061841"}, {"timestamp": "2026-10-28T07:02:44.286Z", "date_only": false, "value": "2026-10-28T07:02:44.286143Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/whatsnew.fyi/post/3myw6n6hxwg2p", "record": "CVE-2026-69150", "field": "creation_timestamp", "uuid": "8d66e266-cf08-4846-b8b8-2b4bfdcaf0d6", "content": "KeePassXC 2.8.0\n\nAdds Wayland Auto-Type, remote database sync, SSH key generation and native Windows Arm64 builds, moves to Qt 6, and fixes a KDB import use-after-free (CVE-2026-69150).", "url": "https://bsky.app/profile/whatsnew.fyi/post/3myw6n6hxwg2p"}, {"timestamp": "2026-10-29T23:00:00Z", "date_only": false, "value": "2026-10-29T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-29T23:00:00Z", "date_only": false, "value": "2026-10-29T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-30T07:08:08.490Z", "date_only": false, "value": "2026-10-30T07:08:08.490+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-07T22:23:55.972Z", "anchors": {"origin": {"timestamp": "2026-09-23T22:00:00Z", "date_only": false, "value": "2026-09-23T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-23T22:00:00Z", "date_only": false, "value": "2026-09-23T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 3889435.972982, "hours": 1080.398881383889, "days": 45.01662005766204, "min_seconds": 3889435.972982, "max_seconds": 3889435.972982, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-23T22:00:00Z", "date_only": false, "value": "2026-09-23T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3560", "record": "WID-SEC-W-2026-3560", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-07T22:23:55.972Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}