{"metadata": {"vulnerability": "GHSA-XQC2-XF4C-X3H3", "count": 16, "kinds": {"milestone": 3, "sighting": 10, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-10-15T05:47:57Z", "date_only": false, "value": "2026-10-15T05:47:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/citadelculture/ff69bfc5b660b3e22da69e16fc7660df", "record": "GHSA-xqc2-xf4c-x3h3", "field": "creation_timestamp", "uuid": "57a359e7-4b82-4102-a597-b71d61f6dc21", "url": "https://gist.github.com/citadelculture/ff69bfc5b660b3e22da69e16fc7660df"}, {"timestamp": "2026-11-09T03:00:16Z", "date_only": false, "value": "2026-11-09T03:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uEXL8cSgiab4Y0PZM_aeWfIbpRKZ2is0uTf5VNyXecOhGtY", "record": "GHSA-XQC2-XF4C-X3H3", "field": "creation_timestamp", "uuid": "5b58bd17-563a-4208-8dad-02b1999d3fed", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-09T03:00:16Z", "date_only": false, "value": "2026-11-09T03:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/uEXL8cSgiab4Y0PZM_aeWfIbpRKZ2is0uTf5VNyXecOhGtY", "record": "GHSA-XQC2-XF4C-X3H3", "field": "creation_timestamp", "uuid": "bc3c8966-daee-4836-8b60-914a8c19116d"}, {"timestamp": "2026-11-09T09:04:21Z", "date_only": false, "value": "2026-11-09T09:04:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/11/09/critical-react-server-components-vulnerability.html", "record": "GHSA-xqc2-xf4c-x3h3", "field": "creation_timestamp", "uuid": "aeaefa8e-5263-4423-aff1-e889979b88ec", "url": "https://threatintel.cc/2026/11/09/critical-react-server-components-vulnerability.html"}, {"timestamp": "2026-11-09T10:04:39.124Z", "date_only": false, "value": "2026-11-09T10:04:39.124465Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117585915326564575", "record": "GHSA-xqc2-xf4c-x3h3", "field": "creation_timestamp", "uuid": "bb119048-b6c9-47d9-9277-76fca9efb12f", "url": "https://infosec.exchange/users/edwardk/statuses/117585915326564575"}, {"timestamp": "2026-11-09T10:04:40.252Z", "date_only": false, "value": "2026-11-09T10:04:40.252518Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzuofkb2xv2c", "record": "GHSA-xqc2-xf4c-x3h3", "field": "creation_timestamp", "uuid": "530ad49b-e201-4063-b7c2-23e591b305de", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzuofkb2xv2c"}, {"timestamp": "2026-11-10T10:01:13Z", "date_only": false, "value": "2026-11-10T10:01:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109935", "record": "GHSA-XQC2-XF4C-X3H3", "field": "creation_timestamp", "uuid": "2a5f234c-881e-4a73-ac10-e4fc983dab12", "url": "https://t.me/GithubRedTeam/109935", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-10T10:01:13Z", "date_only": false, "value": "2026-11-10T10:01:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/109935", "record": "GHSA-XQC2-XF4C-X3H3", "field": "creation_timestamp", "uuid": "70aeafdf-2b0a-4cc9-a672-3fda23f681d4", "url": "https://t.me/GithubRedTeam/109935"}, {"timestamp": "2026-11-10T20:07:44.956Z", "date_only": false, "value": "2026-11-10T20:07:44.956Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2026-126187", "record": "CVE-2026-126187", "field": "cveMetadata.dateReserved", "linked_record": true}, {"timestamp": "2026-11-10T22:33:57.528Z", "date_only": false, "value": "2026-11-10T22:33:57.528Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2026-126187", "record": "CVE-2026-126187", "field": "cveMetadata.datePublished", "linked_record": true}, {"timestamp": "2026-11-10T22:33:57.528Z", "date_only": false, "value": "2026-11-10T22:33:57.528Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2026-126187", "record": "CVE-2026-126187", "field": "cveMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2026-11-10T22:33:57.528Z", "date_only": false, "value": "2026-11-10T22:33:57.528Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2026-126187 / GitHub_M", "record": "CVE-2026-126187", "field": "containers.cna.providerMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2026-11-10T22:44:12Z", "date_only": false, "value": "2026-11-10T22:44:12Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XQC2-XF4C-X3H3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T22:44:12Z", "date_only": false, "value": "2026-11-10T22:44:12Z", "kind": "other", "label": "Updated", "source": "github", "record": "GHSA-XQC2-XF4C-X3H3", "field": "modified"}, {"timestamp": "2026-11-11T00:19:34.287Z", "date_only": false, "value": "2026-11-11T00:19:34.287677Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/chuiho.net/post/3mzyon5jqdf2z", "record": "GHSA-xqc2-xf4c-x3h3", "field": "creation_timestamp", "uuid": "f8b527d0-44a4-4ca7-bf25-0858abc769f3", "url": "https://bsky.app/profile/chuiho.net/post/3mzyon5jqdf2z"}, {"timestamp": "2026-11-11T00:39:12.658Z", "date_only": false, "value": "2026-11-11T00:39:12.658818Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/unnchain.bsky.social/post/3mzypqbojtr2r", "record": "GHSA-xqc2-xf4c-x3h3", "field": "creation_timestamp", "uuid": "cf64ad41-d551-447d-9b20-8f259849f1e2", "url": "https://bsky.app/profile/unnchain.bsky.social/post/3mzypqbojtr2r"}], "metrics": {"as_of": "2026-11-11T07:26:41.429Z", "anchors": {"origin": {"timestamp": "2026-11-10T22:44:12Z", "date_only": false, "value": "2026-11-10T22:44:12Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XQC2-XF4C-X3H3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T22:44:12Z", "date_only": false, "value": "2026-11-10T22:44:12Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XQC2-XF4C-X3H3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-09T03:00:16Z", "date_only": false, "value": "2026-11-09T03:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uEXL8cSgiab4Y0PZM_aeWfIbpRKZ2is0uTf5VNyXecOhGtY", "record": "GHSA-XQC2-XF4C-X3H3", "field": "creation_timestamp", "uuid": "5b58bd17-563a-4208-8dad-02b1999d3fed", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -157436.0, "hours": -43.73222222222222, "days": -1.822175925925926, "min_seconds": -157436.0, "max_seconds": -157436.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-11-10T22:44:12Z", "date_only": false, "value": "2026-11-10T22:44:12Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XQC2-XF4C-X3H3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-09T03:00:16Z", "date_only": false, "value": "2026-11-09T03:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uEXL8cSgiab4Y0PZM_aeWfIbpRKZ2is0uTf5VNyXecOhGtY", "record": "GHSA-XQC2-XF4C-X3H3", "field": "creation_timestamp", "uuid": "5b58bd17-563a-4208-8dad-02b1999d3fed", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 31349.429849, "hours": 8.708174958055556, "days": 0.3628406232523148, "min_seconds": 31349.429849, "max_seconds": 31349.429849, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T22:44:12Z", "date_only": false, "value": "2026-11-10T22:44:12Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XQC2-XF4C-X3H3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T07:26:41.429Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 188785.429849, "hours": 52.44039718027778, "days": 2.1850165491782407, "min_seconds": 188785.429849, "max_seconds": 188785.429849, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T03:00:16Z", "date_only": false, "value": "2026-11-09T03:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uEXL8cSgiab4Y0PZM_aeWfIbpRKZ2is0uTf5VNyXecOhGtY", "record": "GHSA-XQC2-XF4C-X3H3", "field": "creation_timestamp", "uuid": "5b58bd17-563a-4208-8dad-02b1999d3fed", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T07:26:41.429Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}