{"metadata": {"vulnerability": "CVE-2026-93985", "count": 20, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-04T00:00:00Z", "date_only": false, "value": "2026-09-04T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-93985", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-19T10:55:49.093Z", "date_only": false, "value": "2026-09-19T10:55:49.093Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-93985", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-19T11:53:37.061Z", "date_only": false, "value": "2026-09-19T11:53:37.061Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93985", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-19T12:16:41Z", "date_only": false, "value": "2026-09-19T12:16:41Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RQPR-2WVR-29PF", "record": "GHSA-RQPR-2WVR-29PF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-19T12:16:41.873Z", "date_only": false, "value": "2026-09-19T12:16:41.873", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93985", "record": "FKIE_CVE-2026-93985", "field": "published"}, {"timestamp": "2026-09-19T12:32:11Z", "date_only": false, "value": "2026-09-19T12:32:11Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RQPR-2WVR-29PF", "record": "GHSA-RQPR-2WVR-29PF", "field": "published"}, {"timestamp": "2026-09-19T12:32:11Z", "date_only": false, "value": "2026-09-19T12:32:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RQPR-2WVR-29PF", "record": "GHSA-RQPR-2WVR-29PF", "field": "modified"}, {"timestamp": "2026-09-19T13:00:06.720Z", "date_only": false, "value": "2026-09-19T13:00:06.720120Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvuqgcvztz2y", "record": "CVE-2026-93985", "field": "creation_timestamp", "uuid": "31429a0f-7638-4c9a-a37a-6761bd768337", "content": "CVE-2026-93985 - openpanel\nOpenPanel's JavaScript template feature does not properly stop attackers from reaching the system's underlying code engine. If someone can edit project settings, they could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openpanel #openpaneldev #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mvuqgcvztz2y"}, {"timestamp": "2026-09-19T13:30:24.305Z", "date_only": false, "value": "2026-09-19T13:30:24.305038Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117297946535057847", "record": "cve-2026-93985", "field": "creation_timestamp", "uuid": "a1f699bf-74d7-42ad-8ea9-9c83fae5f2e7", "content": "CVE-2026-93985 (CVSS 9.4) in Openpanel-dev openpanel v0: Critical code injection via JS webhook template validator. Attackers with project write access can run arbitrary code in the worker process. Limit permissions & monitor. https://radar.offseq.com/threat/cve-2026-93985-improper-control-of-generation-of-code-code-injection-in-openpanel-dev-openpanel-f8ef9daa74899f8b #OffSeq #Vuln #AppSec", "url": "https://infosec.exchange/users/offseq/statuses/117297946535057847"}, {"timestamp": "2026-09-19T13:30:26.578Z", "date_only": false, "value": "2026-09-19T13:30:26.578018Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvus4jrdzm24", "record": "cve-2026-93985", "field": "creation_timestamp", "uuid": "4b484b3e-bf8d-4914-af0a-1b9429558cfa", "content": "Openpanel-dev openpanel hit by CRITICAL (CVSS 9.4) code injection (CVE-2026-93985). Attackers with project write access can execute arbitrary code. Restrict access & monitor templates. https://radar.offseq.com/threat/cve-2026-93985-improper-control-of-generation-of-code-code-injection-in-openpane...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mvus4jrdzm24"}, {"timestamp": "2026-09-19T13:52:35.113Z", "date_only": false, "value": "2026-09-19T13:52:35.113152Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iapumflcjyc34", "record": "CVE-2026-93985", "field": "creation_timestamp", "uuid": "c89db4f8-ddcd-485f-ab39-b51ed2f492ee", "content": "CVE-2026-93985 - OpenPanel js-runtime JavaScript Template Sandbox Escape RCE\nCVE ID : CVE-2026-93985\n \n Published : Sept. 19, 2026, 12:16 p.m. | 1\u00a0hour, 19\u00a0minutes ago\n \n Description : OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/iapumflcjyc34"}, {"timestamp": "2026-09-19T14:04:27.882Z", "date_only": false, "value": "2026-09-19T14:04:27.882106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvutze5mba2r", "record": "CVE-2026-93985", "field": "creation_timestamp", "uuid": "a516fce9-04a6-41e3-85b6-19aba414c346", "content": "\ud83d\udd34 CVE-2026-93985 - Critical (9.9)\n\nOpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaS...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93985/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvutze5mba2r"}, {"timestamp": "2026-09-19T14:07:06.892Z", "date_only": false, "value": "2026-09-19T14:07:06.892005Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvuu64qiri2y", "record": "CVE-2026-93985", "field": "creation_timestamp", "uuid": "e4f6700d-e80a-4223-b112-678f7313933c", "content": "\ud83d\udea8 CVE-2026-93985 \u2014 CVSS 9.4 CRITICAL\n\nOpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webh...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93985\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mvuu64qiri2y"}, {"timestamp": "2026-09-19T16:01:30.183Z", "date_only": false, "value": "2026-09-19T16:01:30.183330Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/5841827a4cd9286d1b1bda016e23c9f0", "record": "CVE-2026-93985", "field": "creation_timestamp", "uuid": "d99f6679-dbce-4097-94a2-68fdce9d371c", "content": "This daily cyber threat intelligence digest highlights four key developments: (1) identity visibility remains foundational to modern security, despite increasing complexities in cloud and multicloud environments; (2) significant technical and operational hurdles continue to complicate out-of-band patching of compromised Operational Technology (OT) devices; (3) researchers leveraged Anthropic\u2019s Claude Opus 5 to chain vulnerabilities and breach OpenAI employee accounts (CVE-2026-32882, Sept 19, 2026); and (4) a critical RCE vulnerability (CVE-2026-93985, Sept 19, 2026) in OpenPanel\u2019s JavaScript runtime enables sandbox escapes for arbitrary code execution. Together, these updates underscore emerging threats in identity management, OT security, AI-assisted exploitation, and critical software flaws.", "url": "https://gist.github.com/ichintu/5841827a4cd9286d1b1bda016e23c9f0"}, {"timestamp": "2026-09-21T15:32:34.101Z", "date_only": false, "value": "2026-09-21T15:32:34.101291Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93985", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-21T15:32:34.101Z", "date_only": false, "value": "2026-09-21T15:32:34.101291Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93985", "record": "FKIE_CVE-2026-93985", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-21T15:36:36.261Z", "date_only": false, "value": "2026-09-21T15:36:36.261Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93985", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-02T14:00:44.881Z", "date_only": false, "value": "2026-10-02T14:00:44.881Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-93985", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-02T14:00:44.881Z", "date_only": false, "value": "2026-10-02T14:00:44.881Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-93985", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-02T15:17:13.063Z", "date_only": false, "value": "2026-10-02T15:17:13.063", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93985", "record": "FKIE_CVE-2026-93985", "field": "lastModified"}]}