CVE-2026-124850 (GCVE-0-2026-124850)

Vulnerability from cvelistv5 – Published: 2026-11-09 14:43 – Updated: 2026-11-09 14:43
VLAI
Title
SQL Injection in Database Migration via Stored Connector Identifiers in flowintel
Summary
A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade. - Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion Affected versions: flowintel prior to 4.0.0
Severity
7.3 (High)
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-11-09 14:12 UTC
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
CIRCL CNA under the ENISA root
CNA scorecard A 90/100 over 250 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
flowintel flowintel Affected: 0 , ≤ 4.0.0 (semver)
    cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
elhoim David Cruciani
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-11-09 14:12
Model
qwen3.8:27b
Input
https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch 9ad956ded461…
Confidence
medium
Commit Subject Patch SHA-256
061053689dc2 fix: [security] Bind stored connector identifiers during 9ad956ded461…
Fix summary

The vulnerability is remediated by replacing direct string interpolation of stored database values into SQL queries with parameterized (bound) queries, ensuring that user-supplied or stored data is treated strictly as data rather than executable SQL. Additionally, the NULL handling for identifier fields is corrected to use proper SQL NULL instead of the string literal 'null', preventing both injection and unintended data corruption.

Patch summary

In migrations/versions/5cd03995339b_.py, four SQL statements (two SELECT and two UPDATE) are converted from Python f-string interpolation to SQLAlchemy parameterized queries using named bind parameters (:case_id, :instance_id, :ident, :id, :task_id). The NULL identifier handling is changed from assigning the string 'null' to assigning Python None, which SQLAlchemy translates to a proper SQL NULL value.

CVSS rationale

AV:L: The migration runs locally on the application server; exploitation requires local access to the database. AC:H: High complexity because the attacker must first write a crafted identifier into the database and then wait for a migration to execute. AT:P: Attack targeting is present; the attacker must specifically craft a malicious SQL payload in the identifier field. PR:L: Low privilege; the attacker needs write access to the database (e.g., an authenticated application user or DB access). UI:N: The migration runs automatically during upgrade; no user interaction is required at trigger time. VC:H, VI:H, VA:H: Successful SQL injection allows arbitrary read, write, and destructive operations on the database. SC:N, SI:N, SA:N: Impact is confined to the local database; no evidence of cross-component or cross-system impact.

Weakness rationale
  • CWE-89 The patch directly replaces f-string interpolation of stored values into SQL with parameterized queries, which is the canonical fix for CWE-89. The commit message explicitly states that stored identifiers were 'interpolated into SQL, allowing expressions to execute,' confirming SQL injection.
Attack pattern rationale
  • CAPEC-126 The vulnerability is a textbook SQL injection: attacker-controlled data (stored connector identifiers) is concatenated into SQL statements without sanitization or parameterization. CAPEC-126 is the most direct and specific match. The stored nature of the injection (data planted earlier, executed later during migration) is a variant but still falls squarely within this pattern.
Assumptions to verify
  • The affected version range is inferred from the explicit context (affected_version '0', fixed_version '<=4.0.0'); the exact starting version is not confirmed by the patch itself.
  • PR:L assumes the attacker can write to the database via an authenticated application role or direct DB access; the specific authentication mechanism is not stated in the patch.
  • The CVSS impact ratings (VC:H, VI:H, VA:H) assume the database user has broad privileges; if the DB account is highly restricted, impact could be lower.
  • CAPEC-126 is selected as the closest match; the stored/timed nature of the injection (data planted before migration runs) is a variant not explicitly covered by a more specific CAPEC.
  • The patch does not indicate whether the migration has already been executed in deployed instances, which would affect real-world exploitability.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 7 11 medium 5
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-11-06 09:54 UTC Fix developed Corrective change authored (061053689dc279a3c2c182f8dc15cd42dc24bd7d): fix: [security] Bind stored connector identifiers during
  2. 2026-11-09 14:10 UTC Fix available Patch retrieved from the supplied URL; retrieval time is used as the default availability time.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "migrations"
          ],
          "product": "flowintel",
          "programFiles": [
            "migrations/versions/5cd03995339b_.py"
          ],
          "repo": "https://github.com/flowintel/flowintel",
          "vendor": "flowintel",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "elhoim"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "David Cruciani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-11-09T14:12:17Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T14:43:27.959Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is remediated by replacing direct string interpolation of stored database values into SQL queries with parameterized (bound) queries, ensuring that user-supplied or stored data is treated strictly as data rather than executable SQL. Additionally, the NULL handling for identifier fields is corrected to use proper SQL NULL instead of the string literal \u0027null\u0027, preventing both injection and unintended data corruption."
        }
      ],
      "title": "SQL Injection in Database Migration via Stored Connector Identifiers in flowintel",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the explicit context (affected_version \u00270\u0027, fixed_version \u0027\u003c=4.0.0\u0027); the exact starting version is not confirmed by the patch itself.",
                  "PR:L assumes the attacker can write to the database via an authenticated application role or direct DB access; the specific authentication mechanism is not stated in the patch.",
                  "The CVSS impact ratings (VC:H, VI:H, VA:H) assume the database user has broad privileges; if the DB account is highly restricted, impact could be lower.",
                  "CAPEC-126 is selected as the closest match; the stored/timed nature of the injection (data planted before migration runs) is a variant not explicitly covered by a more specific CAPEC.",
                  "The patch does not indicate whether the migration has already been executed in deployed instances, which would affect real-world exploitability."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The vulnerability is a textbook SQL injection: attacker-controlled data (stored connector identifiers) is concatenated into SQL statements without sanitization or parameterization. CAPEC-126 is the most direct and specific match. The stored nature of the injection (data planted earlier, executed later during migration) is a variant but still falls squarely within this pattern."
                  }
                ],
                "commit": "061053689dc279a3c2c182f8dc15cd42dc24bd7d",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "elhoim"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "David Cruciani"
                  }
                ],
                "cvssRationale": "AV:L: The migration runs locally on the application server; exploitation requires local access to the database. AC:H: High complexity because the attacker must first write a crafted identifier into the database and then wait for a migration to execute. AT:P: Attack targeting is present; the attacker must specifically craft a malicious SQL payload in the identifier field. PR:L: Low privilege; the attacker needs write access to the database (e.g., an authenticated application user or DB access). UI:N: The migration runs automatically during upgrade; no user interaction is required at trigger time. VC:H, VI:H, VA:H: Successful SQL injection allows arbitrary read, write, and destructive operations on the database. SC:N, SI:N, SA:N: Impact is confined to the local database; no evidence of cross-component or cross-system impact.",
                "fixSummary": "The vulnerability is remediated by replacing direct string interpolation of stored database values into SQL queries with parameterized (bound) queries, ensuring that user-supplied or stored data is treated strictly as data rather than executable SQL. Additionally, the NULL handling for identifier fields is corrected to use proper SQL NULL instead of the string literal \u0027null\u0027, preventing both injection and unintended data corruption.",
                "generatedAt": "2026-11-09T14:12:17.714022Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "potentialErrors": [],
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9ad956ded461ca4c442070a86c76b0239017eeb48e36892684465b9b6fb4ccde",
                "patchSummary": "In migrations/versions/5cd03995339b_.py, four SQL statements (two SELECT and two UPDATE) are converted from Python f-string interpolation to SQLAlchemy parameterized queries using named bind parameters (:case_id, :instance_id, :ident, :id, :task_id). The NULL identifier handling is changed from assigning the string \u0027null\u0027 to assigning Python None, which SQLAlchemy translates to a proper SQL NULL value.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "061053689dc279a3c2c182f8dc15cd42dc24bd7d",
                    "date": "Fri, 6 Nov 2026 10:54:39 +0100",
                    "patchSha256": "9ad956ded461ca4c442070a86c76b0239017eeb48e36892684465b9b6fb4ccde",
                    "retrievedAt": "2026-11-09T14:10:44.764240Z",
                    "source": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch",
                    "sourceUrl": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch",
                    "subject": "fix: [security] Bind stored connector identifiers during"
                  }
                ],
                "source": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "total"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-11-09T14:12:17Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] Bind stored connector identifiers during",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-89",
                    "rationale": "The patch directly replaces f-string interpolation of stored values into SQL with parameterized queries, which is the canonical fix for CWE-89. The commit message explicitly states that stored identifiers were \u0027interpolated into SQL, allowing expressions to execute,\u0027 confirming SQL injection."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (061053689dc279a3c2c182f8dc15cd42dc24bd7d): fix: [security] Bind stored connector identifiers during",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch"
                    ],
                    "timestamp": "2026-11-06T09:54:39Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.",
                    "id": "evt-fix-available-1",
                    "references": [
                      "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d.patch"
                    ],
                    "timestamp": "2026-11-09T14:10:44.764240Z",
                    "type": "fix-available"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20156"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-124850",
    "datePublished": "2026-11-09T14:43:27.959Z",
    "dateReserved": "2026-11-09T14:38:45.169Z",
    "dateUpdated": "2026-11-09T14:43:27.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*"
                ],
                "modules": [
                  "migrations"
                ],
                "product": "flowintel",
                "programFiles": [
                  "migrations/versions/5cd03995339b_.py"
                ],
                "repo": "https://github.com/flowintel/flowintel",
                "vendor": "flowintel",
                "versions": [
                  {
                    "lessThanOrEqual": "4.0.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0"
          }
        ],
        "id": "CVE-2026-124850",
        "lastModified": "2026-11-09T15:17:19.020",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "ssvcData": {
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "Supplier",
                "timestamp": "2026-11-09T14:12:17Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-09T15:17:19.020",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-89"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.