{"metadata": {"vulnerability": "CVE-2026-96677", "count": 14, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-09-23T15:24:35.832Z", "date_only": false, "value": "2026-09-23T15:24:35.832Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96677", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T11:54:38.096Z", "date_only": false, "value": "2026-11-05T11:54:38.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T11:54:38.096Z", "date_only": false, "value": "2026-11-05T11:54:38.096Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96677", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T11:54:38.096Z", "date_only": false, "value": "2026-11-05T11:54:38.096Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-96677", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T12:00:54.735Z", "date_only": false, "value": "2026-11-05T12:00:54.735715Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117563723229800993", "record": "CVE-2026-96677", "field": "creation_timestamp", "uuid": "e4b712cc-d5b2-4e19-addd-79ef519540ea", "content": "CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.\nHTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected.\nThis issue affects Apache Juneau: through 9.2.0.\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-96677https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6#apache #ApacheSoftwareFoundation #ApacheJuneau#CVE_2026_96677#bot", "url": "https://infosec.exchange/users/cve/statuses/117563723229800993"}, {"timestamp": "2026-11-05T12:17:51Z", "date_only": false, "value": "2026-11-05T12:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C66V-M2X5-FXXR", "record": "GHSA-C66V-M2X5-FXXR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-05T12:17:51.620Z", "date_only": false, "value": "2026-11-05T12:17:51.620", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96677", "record": "FKIE_CVE-2026-96677", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T12:32:14Z", "date_only": false, "value": "2026-11-05T12:32:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C66V-M2X5-FXXR", "record": "GHSA-C66V-M2X5-FXXR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T12:32:14Z", "date_only": false, "value": "2026-11-05T12:32:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C66V-M2X5-FXXR", "record": "GHSA-C66V-M2X5-FXXR", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T13:00:03.709Z", "date_only": false, "value": "2026-11-05T13:00:03.709134Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkwdipeoc2p", "record": "CVE-2026-96677", "field": "creation_timestamp", "uuid": "5cd91d71-f50b-4910-8db8-0cd5704f6690", "content": "CVE-2026-96677 - apache juneau\nApache Juneau versions up to 9.2.0 can insert unchecked request data into page headers and footers, letting attackers inject harmful code into web pages. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachejuneau #apachefoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkwdipeoc2p"}, {"timestamp": "2026-11-05T13:00:40.710Z", "date_only": false, "value": "2026-11-05T13:00:40.710618Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzkwel4ymvgu", "record": "CVE-2026-96677", "field": "creation_timestamp", "uuid": "4c5ffd81-6717-4b93-a9d2-2ce90775ed29", "content": "CVE Radar | CVE-2026-96677 | CVSS 10.0\n\nApache Juneau Chrome XSS\n\nCVE-2026-96677 is a critical cross-site scripting vulnerability in Apache Juneau\u2019s HTML document serialization.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1384", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzkwel4ymvgu"}, {"timestamp": "2026-11-05T13:35:27.686Z", "date_only": false, "value": "2026-11-05T13:35:27.686754Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/euuc7axxpe2pk", "record": "CVE-2026-96677", "field": "creation_timestamp", "uuid": "7721ef2d-8f5a-4f83-be81-8aeac670d0c3", "content": "CVE-2026-96677 - Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome\nCVE ID : CVE-2026-96677\n \n Published : Nov. 5, 2026, 12:17 p.m. | 50\u00a0minutes ago\n \n Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Sc...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/euuc7axxpe2pk"}, {"timestamp": "2026-11-05T14:08:16.542Z", "date_only": false, "value": "2026-11-05T14:08:16.542400Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzl25i4f2l2z", "record": "CVE-2026-96677", "field": "creation_timestamp", "uuid": "08536402-09f4-450f-841d-b16a340ce922", "content": "\ud83d\udea8 CVE-2026-96677 \u2014 CVSS 10 CRITICAL\n\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apach...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-96677\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzl25i4f2l2z"}, {"timestamp": "2026-11-05T15:01:29.553Z", "date_only": false, "value": "2026-11-05T15:01:29.553", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96677", "record": "FKIE_CVE-2026-96677", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-09T17:26:10.738Z", "anchors": {"origin": {"timestamp": "2026-11-05T11:54:38.096Z", "date_only": false, "value": "2026-11-05T11:54:38.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-05T11:54:38.096Z", "date_only": false, "value": "2026-11-05T11:54:38.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 365492.642972, "hours": 101.5257341588889, "days": 4.230238923287037, "min_seconds": 365492.642972, "max_seconds": 365492.642972, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T11:54:38.096Z", "date_only": false, "value": "2026-11-05T11:54:38.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96677", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-09T17:26:10.738Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}