{"metadata": {"vulnerability": "CVE-2026-0828", "count": 30, "kinds": {"milestone": 4, "sighting": 17, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-01-09T19:21:20.617Z", "date_only": false, "value": "2026-01-09T19:21:20.617Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-0828", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-02T14:52:55.462Z", "date_only": false, "value": "2026-04-02T14:52:55.462125Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mijhhjdi3f2u", "record": "cve-2026-0828", "field": "creation_timestamp", "uuid": "d7affafb-3687-4b00-b351-e414adf64c09", "url": "https://bsky.app/profile/oxfemale.bsky.social/post/3mijhhjdi3f2u"}, {"timestamp": "2026-04-02T16:54:00Z", "date_only": false, "value": "2026-04-02T16:54:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/310", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "c000dbed-87cb-4beb-8290-34e74cd45b0d", "content": "KillChain\n\nKernel Process Termination Tool ( CVE-2026-0828 exploit). KillChain is a user-mode tool that leverages a vulnerable kernel driver (ProcessMonitorDriver.sys, CVE-2026-0828) to terminate protected processes from user space. It communicates with the kernel via a custom IOCTL interface, bypassing standard process protection mechanisms.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/310", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-02T21:00:04Z", "date_only": false, "value": "2026-04-02T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xPemCocsCKUXmxN-FoOBBJ3iutE4pbP0FjqrQP2HmxHDku0", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "d4f653c2-da9c-4c67-8a35-2040c8549e38", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-05-27T21:02:13Z", "date_only": false, "value": "2026-05-27T21:02:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/69mEbVY8q7JTbOxcU8Y8fk5qjG-y8rxPRlbyP8YZTdzYGyY", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "94f29690-3dd9-4e4d-8f32-964150e466ea"}, {"timestamp": "2026-06-26T15:47:32.364Z", "date_only": false, "value": "2026-06-26T15:47:32.364Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-0828", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-26T15:47:32.364Z", "date_only": false, "value": "2026-06-26T15:47:32.364Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / certcc", "record": "CVE-2026-0828", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-26T15:50:43.484Z", "date_only": false, "value": "2026-06-26T15:50:43.484Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-0828", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-26T16:16:29Z", "date_only": false, "value": "2026-06-26T16:16:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4P38-3JMX-75VR", "record": "GHSA-4P38-3JMX-75VR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-06-26T16:16:29.860Z", "date_only": false, "value": "2026-06-26T16:16:29.860", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-0828", "record": "FKIE_CVE-2026-0828", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-26T17:33:10.210Z", "date_only": false, "value": "2026-06-26T17:33:10.210218Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-0828", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2026-06-26T17:33:10.210Z", "date_only": false, "value": "2026-06-26T17:33:10.210218Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-0828", "record": "FKIE_CVE-2026-0828", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-06-26T17:33:16.746Z", "date_only": false, "value": "2026-06-26T17:33:16.746Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-0828", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-26T17:33:16.746Z", "date_only": false, "value": "2026-06-26T17:33:16.746Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-0828", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-26T18:33:59Z", "date_only": false, "value": "2026-06-26T18:33:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4P38-3JMX-75VR", "record": "GHSA-4P38-3JMX-75VR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-26T18:33:59Z", "date_only": false, "value": "2026-06-26T18:33:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4P38-3JMX-75VR", "record": "GHSA-4P38-3JMX-75VR", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-15T12:00:02.686Z", "date_only": false, "value": "2026-08-15T12:00:02.686353Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityExploit/31193", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "79b878e4-250d-4aad-837e-8b7aea602c2c", "url": "https://t.me/CyberSecurityExploit/31193"}, {"timestamp": "2026-08-15T12:00:03Z", "date_only": false, "value": "2026-08-15T12:00:03.000277Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityExploit/31192", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "8a21cd16-5961-437e-b32d-ee0def3eacdb", "url": "https://t.me/CyberSecurityExploit/31192"}, {"timestamp": "2026-08-16T00:00:33.721Z", "date_only": false, "value": "2026-08-16T00:00:33.721368Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/31192", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "dc49ec3b-7f95-4fc9-8b67-2101897bc493", "url": "https://t.me/CyberSecurityExploit/31192", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-16T00:00:34.163Z", "date_only": false, "value": "2026-08-16T00:00:34.163643Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/31193", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "cddb426f-0a32-4108-8c0c-48318af06259", "url": "https://t.me/CyberSecurityExploit/31193", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-27T20:00:04.476Z", "date_only": false, "value": "2026-08-27T20:00:04.476163Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityExploit/17202", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "e75531fa-0801-4375-9d11-4837010a845b", "url": "https://t.me/CyberSecurityExploit/17202"}, {"timestamp": "2026-08-28T00:00:11.864Z", "date_only": false, "value": "2026-08-28T00:00:11.864041Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/17202", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "cab41f48-a0ea-4ee6-a320-853dc3f8e7cf", "url": "https://t.me/CyberSecurityExploit/17202", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-02T06:00:15.233Z", "date_only": false, "value": "2026-09-02T06:00:15.233794Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/44388", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "0a86e20e-9fba-4cb8-bf78-f878f64ca43e", "url": "https://t.me/HackingTeamGrupoOfficial/44388"}, {"timestamp": "2026-09-02T15:00:05.952Z", "date_only": false, "value": "2026-09-02T15:00:05.952423Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/100799", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "9948aa83-0c31-4985-8716-ce0bd49b800b", "url": "https://t.me/GithubRedTeam/100799"}, {"timestamp": "2026-09-03T00:00:43.505Z", "date_only": false, "value": "2026-09-03T00:00:43.505229Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/100799", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "89b9925f-f0c4-4196-bd60-81eba0878e93", "url": "https://t.me/GithubRedTeam/100799", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-03T00:00:47.422Z", "date_only": false, "value": "2026-09-03T00:00:47.422670Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingTeamGrupoOfficial/44388", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "c2f35e2d-f399-4bef-9333-9d085068de2c", "url": "https://t.me/HackingTeamGrupoOfficial/44388", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-03T03:00:05.595Z", "date_only": false, "value": "2026-09-03T03:00:05.595157Z", "kind": "sighting", "label": "Seen", "source": "Telegram/PrO6w3QLOr3jUo9xBtS3NN22LRqKedjWuLvWfaGQXc76APg", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "15652bbc-4c7d-4de0-b83d-24f834ee1796"}, {"timestamp": "2026-09-04T00:01:01.692Z", "date_only": false, "value": "2026-09-04T00:01:01.692297Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/PrO6w3QLOr3jUo9xBtS3NN22LRqKedjWuLvWfaGQXc76APg", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "347134c9-fdb5-471a-97e1-5de78b8a869d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-01T00:00:07Z", "date_only": false, "value": "2026-10-01T00:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103911", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "11951a29-2f4b-4a8f-8b03-d1681b1b1edf", "url": "https://t.me/GithubRedTeam/103911", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T17:10:00.197Z", "date_only": false, "value": "2026-10-25T17:10:00.197", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-0828", "record": "FKIE_CVE-2026-0828", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T20:43:15.864Z", "anchors": {"origin": {"timestamp": "2026-06-26T15:47:32.364Z", "date_only": false, "value": "2026-06-26T15:47:32.364Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-0828", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-26T15:47:32.364Z", "date_only": false, "value": "2026-06-26T15:47:32.364Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-0828", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-04-02T16:54:00Z", "date_only": false, "value": "2026-04-02T16:54:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/310", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "c000dbed-87cb-4beb-8290-34e74cd45b0d", "content": "KillChain\n\nKernel Process Termination Tool ( CVE-2026-0828 exploit). KillChain is a user-mode tool that leverages a vulnerable kernel driver (ProcessMonitorDriver.sys, CVE-2026-0828) to terminate protected processes from user space. It communicates with the kernel via a custom IOCTL interface, bypassing standard process protection mechanisms.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/310", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -7340012.364, "hours": -2038.8923233333333, "days": -84.95384680555556, "min_seconds": -7340012.364, "max_seconds": -7340012.364, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-06-26T15:47:32.364Z", "date_only": false, "value": "2026-06-26T15:47:32.364Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-0828", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-04-02T16:54:00Z", "date_only": false, "value": "2026-04-02T16:54:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/310", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "c000dbed-87cb-4beb-8290-34e74cd45b0d", "content": "KillChain\n\nKernel Process Termination Tool ( CVE-2026-0828 exploit). KillChain is a user-mode tool that leverages a vulnerable kernel driver (ProcessMonitorDriver.sys, CVE-2026-0828) to terminate protected processes from user space. It communicates with the kernel via a custom IOCTL interface, bypassing standard process protection mechanisms.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/310", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 12113743.50093, "hours": 3364.9287502583334, "days": 140.20536459409723, "min_seconds": 12113743.50093, "max_seconds": 12113743.50093, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-26T15:47:32.364Z", "date_only": false, "value": "2026-06-26T15:47:32.364Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-0828", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T20:43:15.864Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 19453755.86493, "hours": 5403.821073591666, "days": 225.15921139965278, "min_seconds": 19453755.86493, "max_seconds": 19453755.86493, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-02T16:54:00Z", "date_only": false, "value": "2026-04-02T16:54:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/310", "record": "CVE-2026-0828", "field": "creation_timestamp", "uuid": "c000dbed-87cb-4beb-8290-34e74cd45b0d", "content": "KillChain\n\nKernel Process Termination Tool ( CVE-2026-0828 exploit). KillChain is a user-mode tool that leverages a vulnerable kernel driver (ProcessMonitorDriver.sys, CVE-2026-0828) to terminate protected processes from user space. It communicates with the kernel via a custom IOCTL interface, bypassing standard process protection mechanisms.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/310", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-13T20:43:15.864Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}