{"metadata": {"vulnerability": "cve-2026-52887", "count": 23, "kinds": {"milestone": 4, "sighting": 11, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-08T21:44:27.365Z", "date_only": false, "value": "2026-06-08T21:44:27.365Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-52887", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-15T20:16:43.023Z", "date_only": false, "value": "2026-07-15T20:16:43.023Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-52887", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-15T20:16:43.023Z", "date_only": false, "value": "2026-07-15T20:16:43.023Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-52887", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-15T21:04:09.596Z", "date_only": false, "value": "2026-07-15T21:04:09.596663Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpmoxunof2w", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "1483f96f-83fc-42a4-9094-737a55f038ff", "content": "CVE-2026-52887 - nocobase\nNocoBase's in-app messaging feature allows attackers to inject malicious SQL code. This could potentially give an attacker control over a database and allow them to execute unauthorized\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nocobase #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpmoxunof2w"}, {"timestamp": "2026-07-15T21:16:54Z", "date_only": false, "value": "2026-07-15T21:16:54Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P849-8HWH-84J9", "record": "GHSA-P849-8HWH-84J9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-15T21:16:54.543Z", "date_only": false, "value": "2026-07-15T21:16:54.543", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52887", "record": "FKIE_CVE-2026-52887", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-15T22:00:37.725Z", "date_only": false, "value": "2026-07-15T22:00:37.725597Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqppu2ragj2n", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "10446587-7ea4-43a9-800e-78071230b658", "content": "\ud83d\udd34 CVE-2026-52887 - Critical (10)\n\nNocoBase is an AI-powered no-code/low-code platform for building business applications and enterp...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-52887/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqppu2ragj2n"}, {"timestamp": "2026-07-16T00:53:54.505Z", "date_only": false, "value": "2026-07-16T00:53:54.505971Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpzjwga2c2m", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "5d5386bf-7c45-4299-99f4-54f4a58f48bd", "content": "CVE-2026-52887 - NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE\nCVE ID : CVE-2026-52887\n \n Published : July 15, 2026, 9:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : NocoBase is an AI-powered no-code/low-code platform for building business ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpzjwga2c2m"}, {"timestamp": "2026-07-18T04:18:03.711Z", "date_only": false, "value": "2026-07-18T04:18:03.711327Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqvfustm4y2s", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "6dec95bb-db51-4cee-ad51-edf0c9570e16", "content": "CVE-2026-52887\nA security issue in NocoBase's notification plugin could allow an authenticated user to execute malicious code on the database. This could lead to unauthorized access and data theft. NocoBase has released a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqvfustm4y2s"}, {"timestamp": "2026-07-20T14:39:37.974Z", "date_only": false, "value": "2026-07-20T14:39:37.974692Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-52887", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-20T14:39:37.974Z", "date_only": false, "value": "2026-07-20T14:39:37.974692Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52887", "record": "FKIE_CVE-2026-52887", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-20T14:39:47.788Z", "date_only": false, "value": "2026-07-20T14:39:47.788Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-52887", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-20T14:39:47.788Z", "date_only": false, "value": "2026-07-20T14:39:47.788Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-52887", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-20T16:17:05.020Z", "date_only": false, "value": "2026-07-20T16:17:05.020", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52887", "record": "FKIE_CVE-2026-52887", "field": "lastModified"}, {"timestamp": "2026-07-31T19:44:59Z", "date_only": false, "value": "2026-07-31T19:44:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P849-8HWH-84J9", "record": "GHSA-P849-8HWH-84J9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-31T19:44:59Z", "date_only": false, "value": "2026-07-31T19:44:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P849-8HWH-84J9", "record": "GHSA-P849-8HWH-84J9", "field": "modified"}, {"timestamp": "2026-08-03T05:00:03.076Z", "date_only": false, "value": "2026-08-03T05:00:03.076625Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/96368", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "07ebaf4c-e864-4f9f-b24e-e0e96a5c4bc6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-52887-NocoBase-SQLi-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiiTts\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 03:57:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-52887 \u2014 NocoBase SQL injection -> PostgreSQL-superuser RCE (myInAppChannels:list filter, CVSS 10.0). Author PoC + source analysis + docker lab.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96368"}, {"timestamp": "2026-08-03T08:00:03.201Z", "date_only": false, "value": "2026-08-03T08:00:03.201612Z", "kind": "sighting", "label": "Seen", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "1eba33c4-35bd-4065-92b4-cb0511bbc4b9"}, {"timestamp": "2026-08-03T11:08:45.204Z", "date_only": false, "value": "2026-08-03T11:08:45.204832Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "1ad996e2-7588-4ec5-af76-af8de0eddccc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-04T00:00:44.084Z", "date_only": false, "value": "2026-08-04T00:00:44.084826Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "40fd2a16-a99b-45d5-9619-3652c06bacaa", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-04T00:00:48.592Z", "date_only": false, "value": "2026-08-04T00:00:48.592690Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96368", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "2516ce29-9ddc-41c7-82d8-1f5cc1866afb", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-52887-NocoBase-SQLi-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiiTts\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 03:57:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-52887 \u2014 NocoBase SQL injection -> PostgreSQL-superuser RCE (myInAppChannels:list filter, CVSS 10.0). Author PoC + source analysis + docker lab.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96368", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-21T16:03:46Z", "date_only": false, "value": "2026-10-21T16:03:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/106372", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "b12d1955-5abb-45f0-a551-2673b60978fd", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a nocobase-cve-2026-52887\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pentrestion\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-21 15:56:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNocoBase security research and exploitation notes for CVE-2026-52887, structured for documentation and reproduction scripts.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/106372", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-21T16:03:46Z", "date_only": false, "value": "2026-10-21T16:03:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/106372", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "ff5933ba-b0f5-47ae-bdac-c6fdf849af65", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a nocobase-cve-2026-52887\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pentrestion\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-21 15:56:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNocoBase security research and exploitation notes for CVE-2026-52887, structured for documentation and reproduction scripts.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/106372"}], "metrics": {"as_of": "2026-10-30T18:58:17.798Z", "anchors": {"origin": {"timestamp": "2026-07-15T20:16:43.023Z", "date_only": false, "value": "2026-07-15T20:16:43.023Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-52887", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-15T20:16:43.023Z", "date_only": false, "value": "2026-07-15T20:16:43.023Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-52887", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-08-03T11:08:45.204Z", "date_only": false, "value": "2026-08-03T11:08:45.204832Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "1ad996e2-7588-4ec5-af76-af8de0eddccc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1608722.181, "hours": 446.8672725, "days": 18.6194696875, "min_seconds": 1608722.181, "max_seconds": 1608722.181, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-15T20:16:43.023Z", "date_only": false, "value": "2026-07-15T20:16:43.023Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-52887", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-03T11:08:45.204Z", "date_only": false, "value": "2026-08-03T11:08:45.204832Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "1ad996e2-7588-4ec5-af76-af8de0eddccc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 9240094.775637, "hours": 2566.6929932325, "days": 106.94554138468752, "min_seconds": 9240094.775637, "max_seconds": 9240094.775637, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-15T20:16:43.023Z", "date_only": false, "value": "2026-07-15T20:16:43.023Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-52887", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T18:58:17.798Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 7631372.594637, "hours": 2119.8257207325, "days": 88.3260716971875, "min_seconds": 7631372.594637, "max_seconds": 7631372.594637, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-03T11:08:45.204Z", "date_only": false, "value": "2026-08-03T11:08:45.204832Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "record": "CVE-2026-52887", "field": "creation_timestamp", "uuid": "1ad996e2-7588-4ec5-af76-af8de0eddccc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-30T18:58:17.798Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}