{"metadata": {"vulnerability": "cve-2026-87016", "count": 17, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-08T16:44:23.783Z", "date_only": false, "value": "2026-09-08T16:44:23.783Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-87016", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-09T21:21:43.877Z", "date_only": false, "value": "2026-09-09T21:21:43.877Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-87016", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-09T21:21:43.877Z", "date_only": false, "value": "2026-09-09T21:21:43.877Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-87016", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-09T22:18:46Z", "date_only": false, "value": "2026-09-09T22:18:46Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WPMR-8H3Q-FWJ7", "record": "GHSA-WPMR-8H3Q-FWJ7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-09T22:18:46.720Z", "date_only": false, "value": "2026-09-09T22:18:46.720", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87016", "record": "FKIE_CVE-2026-87016", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-09T23:01:16.065Z", "date_only": false, "value": "2026-09-09T23:01:16.065269Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4ndzoauy24", "record": "CVE-2026-87016", "field": "creation_timestamp", "uuid": "9e25c765-1253-410b-9d9f-1373b50b4103", "content": "\ud83d\udfe0 CVE-2026-87016 - High (8.1)\n\nOpen WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-87016/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4ndzoauy24"}, {"timestamp": "2026-09-10T21:23:25Z", "date_only": false, "value": "2026-09-10T21:23:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WPMR-8H3Q-FWJ7", "record": "GHSA-WPMR-8H3Q-FWJ7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-10T21:23:25Z", "date_only": false, "value": "2026-09-10T21:23:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WPMR-8H3Q-FWJ7", "record": "GHSA-WPMR-8H3Q-FWJ7", "field": "modified"}, {"timestamp": "2026-09-10T22:35:05.741Z", "date_only": false, "value": "2026-09-10T22:35:05.741380Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "record": "CVE-2026-87016", "field": "creation_timestamp", "uuid": "c5d1e597-5435-4e7a-857d-c65c09ae5cfd", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-14T13:43:02.743Z", "date_only": false, "value": "2026-09-14T13:43:02.743594Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-87016", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-14T13:43:02.743Z", "date_only": false, "value": "2026-09-14T13:43:02.743594Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87016", "record": "FKIE_CVE-2026-87016", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-14T13:43:30.787Z", "date_only": false, "value": "2026-09-14T13:43:30.787Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-87016", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-14T13:43:30.787Z", "date_only": false, "value": "2026-09-14T13:43:30.787Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-87016", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T15:29:13.380Z", "date_only": false, "value": "2026-09-15T15:29:13.380", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87016", "record": "FKIE_CVE-2026-87016", "field": "lastModified"}, {"timestamp": "2026-09-16T15:37:07.621Z", "date_only": false, "value": "2026-09-16T15:37:07.621710Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvnhscstap2p", "record": "CVE-2026-87016", "field": "creation_timestamp", "uuid": "b2f7bbf8-bb4a-47d6-ab32-c4b49ccaa91b", "content": "\ud83d\udccc CVE-2026-87016 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_... https://www.cyberhub.blog/cves/CVE-2026-87016", "url": "https://bsky.app/profile/cyberhub.blog/post/3mvnhscstap2p"}, {"timestamp": "2026-10-01T16:38:29.970Z", "date_only": false, "value": "2026-10-01T16:38:29.970442Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4128", "record": "PYSEC-2026-4128", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-01T17:10:35.095Z", "date_only": false, "value": "2026-10-01T17:10:35.095653Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4128", "record": "PYSEC-2026-4128", "field": "modified"}], "metrics": {"as_of": "2026-10-29T10:34:24.477Z", "anchors": {"origin": {"timestamp": "2026-09-09T21:21:43.877Z", "date_only": false, "value": "2026-09-09T21:21:43.877Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-87016", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-09T21:21:43.877Z", "date_only": false, "value": "2026-09-09T21:21:43.877Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-87016", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-10T22:35:05.741Z", "date_only": false, "value": "2026-09-10T22:35:05.741380Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "record": "CVE-2026-87016", "field": "creation_timestamp", "uuid": "c5d1e597-5435-4e7a-857d-c65c09ae5cfd", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 90801.864, "hours": 25.22274, "days": 1.0509475, "min_seconds": 90801.864, "max_seconds": 90801.864, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-09T21:21:43.877Z", "date_only": false, "value": "2026-09-09T21:21:43.877Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-87016", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-10T22:35:05.741Z", "date_only": false, "value": "2026-09-10T22:35:05.741380Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "record": "CVE-2026-87016", "field": "creation_timestamp", "uuid": "c5d1e597-5435-4e7a-857d-c65c09ae5cfd", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 4281160.60038, "hours": 1189.2112778833332, "days": 49.55046991180555, "min_seconds": 4281160.60038, "max_seconds": 4281160.60038, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-09T21:21:43.877Z", "date_only": false, "value": "2026-09-09T21:21:43.877Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-87016", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T10:34:24.477Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 4190358.73638, "hours": 1163.9885378833333, "days": 48.49952241180556, "min_seconds": 4190358.73638, "max_seconds": 4190358.73638, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-10T22:35:05.741Z", "date_only": false, "value": "2026-09-10T22:35:05.741380Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "record": "CVE-2026-87016", "field": "creation_timestamp", "uuid": "c5d1e597-5435-4e7a-857d-c65c09ae5cfd", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T10:34:24.477Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}