{"metadata": {"vulnerability": "CVE-2026-86009", "count": 8, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-09-04T19:17:36.246Z", "date_only": false, "value": "2026-09-04T19:17:36.246Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-86009", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T16:19:06.420Z", "date_only": false, "value": "2026-10-16T16:19:06.420Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86009", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T16:19:06.420Z", "date_only": false, "value": "2026-10-16T16:19:06.420Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-86009", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:19:06.420Z", "date_only": false, "value": "2026-10-16T16:19:06.420Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-86009", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:31:10.057Z", "date_only": false, "value": "2026-10-16T16:31:10.057493Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117451533829537712", "record": "CVE-2026-86009", "field": "creation_timestamp", "uuid": "65cea352-a319-47df-84d3-1dc6f2f8d097", "content": "CVE-2026-86009 Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.\nhttps://www.cve.org/CVERecord?id=CVE-2026-86009https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfmhttps://github.com/Mailu/Mailu/issues/2686https://github.com/Mailu/Mailu/pull/4072https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96#Mailu#CVE_2026_86009#bot", "url": "https://infosec.exchange/users/cve/statuses/117451533829537712"}, {"timestamp": "2026-10-16T17:17:51.920Z", "date_only": false, "value": "2026-10-16T17:17:51.920", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86009", "record": "FKIE_CVE-2026-86009", "field": "published"}, {"timestamp": "2026-10-16T17:17:52.030Z", "date_only": false, "value": "2026-10-16T17:17:52.030", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86009", "record": "FKIE_CVE-2026-86009", "field": "lastModified"}, {"timestamp": "2026-10-16T18:15:17.870Z", "date_only": false, "value": "2026-10-16T18:15:17.870019Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5ebt7hmjreski", "record": "CVE-2026-86009", "field": "creation_timestamp", "uuid": "c3a5d4ad-8995-4ca2-83c4-b140ec1e2ed3", "content": "CVE-2026-86009 - Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control\nCVE ID : CVE-2026-86009\n \n Published : Oct. 16, 2026, 5:17 p.m. | 16\u00a0minutes ago\n \n Description : Mailu is a mail server distributed as a set of Docker images....", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/5ebt7hmjreski"}]}