{"metadata": {"vulnerability": "CVE-2026-7003", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-04-24T20:48:13.513Z", "date_only": false, "value": "2026-04-24T20:48:13.513Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-7003", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-7003", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T18:58:29.306Z", "date_only": false, "value": "2026-10-30T18:58:29.306Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-7003", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T18:58:29.306Z", "date_only": false, "value": "2026-10-30T18:58:29.306Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-7003", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T19:13:57.704Z", "date_only": false, "value": "2026-10-30T19:13:57.704286Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117531452191602584", "record": "CVE-2026-7003", "field": "creation_timestamp", "uuid": "7dec25e3-56e8-4432-b63b-8eb6fdfa67be", "content": "CVE-2026-7003 WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-7003https://github.com/kmkz/Exploits/tree/4e8e8b995d10a78f58336f54517142b6791d57d4/2026/CVE-2026-7003-7004-7005-WIThttps://www.vulncheck.com/advisories/wit-synapps-runtime-hardcoded-oauth-credentials-disclosure#WIT #SynAppsRuntime#CVE_2026_7003#bot", "url": "https://infosec.exchange/users/cve/statuses/117531452191602584"}, {"timestamp": "2026-10-30T19:14:37.985Z", "date_only": false, "value": "2026-10-30T19:14:37.985236Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117531454833618261", "record": "CVE-2026-7003", "field": "creation_timestamp", "uuid": "60e288b0-a345-4ba4-9d93-0bd341ab82d0", "content": "CVE-2026-7004 WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.\nhttps://www.cve.org/CVERecord?id=CVE-2026-7004https://github.com/kmkz/Exploits/tree/4e8e8b995d10a78f58336f54517142b6791d57d4/2026/CVE-2026-7003-7004-7005-WIThttps://www.vulncheck.com/advisories/wit-synapps-runtime-reflected-xss-via-link-parameter#WIT #SynAppsRuntime#CVE_2026_7004#bot", "url": "https://infosec.exchange/users/cve/statuses/117531454833618261"}, {"timestamp": "2026-10-30T19:16:12.332Z", "date_only": false, "value": "2026-10-30T19:16:12.332115Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117531460125065473", "record": "CVE-2026-7003", "field": "creation_timestamp", "uuid": "3bc5e12f-3c6c-4273-9127-a20561998507", "content": "CVE-2026-7005 WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.\nhttps://www.cve.org/CVERecord?id=CVE-2026-7005https://github.com/kmkz/Exploits/tree/4e8e8b995d10a78f58336f54517142b6791d57d4/2026/CVE-2026-7003-7004-7005-WIThttps://www.vulncheck.com/advisories/wit-synapps-runtime-browser-mediated-ssrf-via-controller-onboarding#WIT #SynAppsRuntime#CVE_2026_7005#bot", "url": "https://infosec.exchange/users/cve/statuses/117531460125065473"}, {"timestamp": "2026-10-30T19:19:13Z", "date_only": false, "value": "2026-10-30T19:19:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QXH8-8WMV-C8MP", "record": "GHSA-QXH8-8WMV-C8MP", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-30T19:19:13.647Z", "date_only": false, "value": "2026-10-30T19:19:13.647", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-7003", "record": "FKIE_CVE-2026-7003", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T21:32:21Z", "date_only": false, "value": "2026-10-30T21:32:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QXH8-8WMV-C8MP", "record": "GHSA-QXH8-8WMV-C8MP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T21:32:21Z", "date_only": false, "value": "2026-10-30T21:32:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QXH8-8WMV-C8MP", "record": "GHSA-QXH8-8WMV-C8MP", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T17:32:31.521Z", "date_only": false, "value": "2026-11-06T17:32:31.521565Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-7003", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-06T17:32:31.521Z", "date_only": false, "value": "2026-11-06T17:32:31.521565Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-7003", "record": "FKIE_CVE-2026-7003", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-06T17:35:38.578Z", "date_only": false, "value": "2026-11-06T17:35:38.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-7003", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T17:35:38.578Z", "date_only": false, "value": "2026-11-06T17:35:38.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-7003", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T18:18:19.777Z", "date_only": false, "value": "2026-11-06T18:18:19.777", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-7003", "record": "FKIE_CVE-2026-7003", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T18:44:00.535Z", "anchors": {"origin": {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-7003", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-7003", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 845040.535273, "hours": 234.7334820202778, "days": 9.780561750844907, "min_seconds": 758640.535273, "max_seconds": 845040.535273, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-7003", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T18:44:00.535Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}