{"metadata": {"vulnerability": "cve-2026-109566", "count": 13, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109566", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T19:27:53.420Z", "date_only": false, "value": "2026-10-12T19:27:53.420Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109566", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T20:55:19.825Z", "date_only": false, "value": "2026-10-12T20:55:19.825Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109566", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T20:55:19.825Z", "date_only": false, "value": "2026-10-12T20:55:19.825Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109566", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T20:55:19.825Z", "date_only": false, "value": "2026-10-12T20:55:19.825Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109566", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T21:17:13Z", "date_only": false, "value": "2026-10-12T21:17:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8X56-M6RJ-FF6Q", "record": "GHSA-8X56-M6RJ-FF6Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T21:17:13.190Z", "date_only": false, "value": "2026-10-12T21:17:13.190", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109566", "record": "FKIE_CVE-2026-109566", "field": "published"}, {"timestamp": "2026-10-12T21:32:00Z", "date_only": false, "value": "2026-10-12T21:32:00Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8X56-M6RJ-FF6Q", "record": "GHSA-8X56-M6RJ-FF6Q", "field": "published"}, {"timestamp": "2026-10-12T21:32:00Z", "date_only": false, "value": "2026-10-12T21:32:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8X56-M6RJ-FF6Q", "record": "GHSA-8X56-M6RJ-FF6Q", "field": "modified"}, {"timestamp": "2026-10-12T21:43:49.278Z", "date_only": false, "value": "2026-10-12T21:43:49.278770Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117430119872096885", "record": "CVE-2026-109566", "field": "creation_timestamp", "uuid": "0c86c374-0819-41d8-995b-db721562844f", "content": "CVE-2026-109566 Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109566https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406ahttps://github.com/zofe/rapyd-admin/releases/tag/v9.20.0https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/Modules/Auth/Database/Seeders/AuthSeeder.php#L29-L34https://github.com/zofe/rapyd-adminhttps://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-hard-coded-super-admin-credentials-via-authseeder#zofe #rapyd-admin#CVE_2026_109566#bot", "url": "https://infosec.exchange/users/cve/statuses/117430119872096885"}, {"timestamp": "2026-10-12T21:50:06.273Z", "date_only": false, "value": "2026-10-12T21:50:06.273339Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpir732tl2z", "record": "CVE-2026-109566", "field": "creation_timestamp", "uuid": "304390b3-f8a3-4724-92cb-675223400e5e", "content": "CVE-2026-109566 - rapyd-admin\nThe Rapyd\u2011Admin tool (versions 9.0.0 through 9.19.x) creates a default admin account named admin@laravel with the password \u2018admin\u2019. Because this account is automatically\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rapydadmin #zofe #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpir732tl2z"}, {"timestamp": "2026-10-12T22:09:31.854Z", "date_only": false, "value": "2026-10-12T22:09:31.854908Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpjtwc7nj2l", "record": "CVE-2026-109566", "field": "creation_timestamp", "uuid": "4c82094c-6558-4d0d-a4eb-5cafcbad3f25", "content": "\ud83d\udea8 CVE-2026-109566 \u2014 CVSS 9.3 CRITICAL\n\nRapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote una...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-109566\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpjtwc7nj2l"}, {"timestamp": "2026-10-16T19:18:44.867Z", "date_only": false, "value": "2026-10-16T19:18:44.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109566", "record": "FKIE_CVE-2026-109566", "field": "lastModified"}]}