{"metadata": {"vulnerability": "CVE-2026-94483", "count": 29, "kinds": {"milestone": 8, "sighting": 4, "kev": 0, "other": 17}}, "data": [{"timestamp": "2026-09-21T17:25:42.292Z", "date_only": false, "value": "2026-09-21T17:25:42.292Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-94483", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-30T22:00:00Z", "date_only": false, "value": "2026-09-30T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-09-30T22:00:00Z", "date_only": false, "value": "2026-09-30T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-30T22:00:00Z", "date_only": false, "value": "2026-09-30T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "vulnerabilities.1.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-01T22:00:00Z", "date_only": false, "value": "2026-10-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-02T15:18:38.684Z", "date_only": false, "value": "2026-10-02T15:18:38.684Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94483", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-02T15:18:38.684Z", "date_only": false, "value": "2026-10-02T15:18:38.684Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-94483", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-02T16:16:51Z", "date_only": false, "value": "2026-10-02T16:16:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CJQ9-62Q9-8JV4", "record": "GHSA-CJQ9-62Q9-8JV4", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-02T16:16:51.473Z", "date_only": false, "value": "2026-10-02T16:16:51.473", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94483", "record": "FKIE_CVE-2026-94483", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-04T22:00:00Z", "date_only": false, "value": "2026-10-04T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-04T22:00:00Z", "date_only": false, "value": "2026-10-04T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-05T09:35:48.684Z", "date_only": false, "value": "2026-10-05T09:35:48.684+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-06T16:33:15.240Z", "date_only": false, "value": "2026-10-06T16:33:15.240863Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94483", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-06T16:33:15.240Z", "date_only": false, "value": "2026-10-06T16:33:15.240863Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94483", "record": "FKIE_CVE-2026-94483", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-06T16:33:25.979Z", "date_only": false, "value": "2026-10-06T16:33:25.979Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-94483", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-06T16:33:25.979Z", "date_only": false, "value": "2026-10-06T16:33:25.979Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94483", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-06T17:17:27.837Z", "date_only": false, "value": "2026-10-06T17:17:27.837", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94483", "record": "FKIE_CVE-2026-94483", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-06T20:07:08.203Z", "date_only": false, "value": "2026-10-06T20:07:08.203742Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mxaa7jp56e2m", "record": "CVE-2026-94483", "field": "creation_timestamp", "uuid": "30868e7b-717f-473e-bacc-59452a5ef1e3", "content": "\ud83d\udccc CVE-2026-94483 - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS... https://www.cyberhub.blog/cves/CVE-2026-94483", "url": "https://bsky.app/profile/cyberhub.blog/post/3mxaa7jp56e2m"}, {"timestamp": "2026-10-06T20:26:42.376Z", "date_only": false, "value": "2026-10-06T20:26:42.376600Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mxabck7sar25", "record": "CVE-2026-94483", "field": "creation_timestamp", "uuid": "4da0c89a-3fe4-4297-8556-3e17459fd81b", "content": "\ud83d\udccc CVE-2026-94483 - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS... https://www.potatohub.blog/cves/CVE-2026-94483", "url": "https://bsky.app/profile/potato.software/post/3mxabck7sar25"}, {"timestamp": "2026-10-07T20:30:55Z", "date_only": false, "value": "2026-10-07T20:30:55Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CJQ9-62Q9-8JV4", "record": "GHSA-CJQ9-62Q9-8JV4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-07T20:30:55Z", "date_only": false, "value": "2026-10-07T20:30:55Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CJQ9-62Q9-8JV4", "record": "GHSA-CJQ9-62Q9-8JV4", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-08T03:26:21.797Z", "date_only": false, "value": "2026-10-08T03:26:21.797531Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mxdj7ubtws2q", "record": "CVE-2026-94483", "field": "creation_timestamp", "uuid": "f2d30c81-a377-455d-9658-c139f7c6d8b1", "content": "The latest update for #CyCognito includes \"Emerging Threat: (CVE-2026-21589) Atlassian Data Center Arbitrary File Access via Path Traversal\" and \"Emerging Threat: (CVE-2026-94483) Next.js Server-Side Request Forgery via Image Optimization\".\n \n#cybersecurity #EASM https://opsmtrs.com/44Srq0X", "url": "https://bsky.app/profile/opsmatters.com/post/3mxdj7ubtws2q"}, {"timestamp": "2026-10-09T07:34:48Z", "date_only": false, "value": "2026-10-09T07:34:48Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-WN21226", "record": "CLEANSTART-2026-WN21226", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-10T00:40:44.282Z", "date_only": false, "value": "2026-10-10T00:40:44.282181Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-WN21226", "record": "CLEANSTART-2026-WN21226", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-14T12:19:50Z", "date_only": false, "value": "2026-10-14T12:19:50Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-CR16347", "record": "CLEANSTART-2026-CR16347", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-15T00:40:45.092Z", "date_only": false, "value": "2026-10-15T00:40:45.092181Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-CR16347", "record": "CLEANSTART-2026-CR16347", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-26T17:51:04.264Z", "date_only": false, "value": "2026-10-26T17:51:04.264788Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stacksiren.bsky.social/post/3mysbwmrwrc27", "record": "CVE-2026-94483", "field": "creation_timestamp", "uuid": "1690ea56-eef3-4ac8-9f4b-ea434c907a26", "content": "Next.js CVE-2026-94483 is an Image Optimization SSRF fixed in 15.5.27 and 16.3.8. Apps without images.remotePatterns aren't affected.\nnextjs.org/blog/septemb...", "url": "https://bsky.app/profile/stacksiren.bsky.social/post/3mysbwmrwrc27"}, {"timestamp": "2026-10-27T07:25:20Z", "date_only": false, "value": "2026-10-27T07:25:20Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-JD47391", "record": "CLEANSTART-2026-JD47391", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-28T00:36:11.630Z", "date_only": false, "value": "2026-10-28T00:36:11.630301Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-JD47391", "record": "CLEANSTART-2026-JD47391", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}], "metrics": {"as_of": "2026-11-05T01:19:15.165Z", "anchors": {"origin": {"timestamp": "2026-09-30T22:00:00Z", "date_only": false, "value": "2026-09-30T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-30T22:00:00Z", "date_only": false, "value": "2026-09-30T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 3035955.165404, "hours": 843.3208792788888, "days": 35.1383699699537, "min_seconds": 3035955.165404, "max_seconds": 3035955.165404, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-30T22:00:00Z", "date_only": false, "value": "2026-09-30T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3699", "record": "WID-SEC-W-2026-3699", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-05T01:19:15.165Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}