{"metadata": {"vulnerability": "CVE-2026-112136", "count": 25, "kinds": {"milestone": 6, "sighting": 6, "kev": 0, "other": 13}, "linked_omitted": 0}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0479", "record": "NCSC-2026-0479", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-19T04:39:55.733Z", "date_only": false, "value": "2026-10-19T04:39:55.733Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112136", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T08:32:39Z", "date_only": false, "value": "2026-11-10T08:32:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-siemens", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "45aa85ab-8470-4f44-a02f-e3863f6765ac", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-siemens"}, {"timestamp": "2026-11-10T11:30:41.077Z", "date_only": false, "value": "2026-11-10T11:30:41.077Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112136", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T11:30:41.077Z", "date_only": false, "value": "2026-11-10T11:30:41.077Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / siemens", "record": "CVE-2026-112136", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T11:40:38.914Z", "date_only": false, "value": "2026-11-10T11:40:38.914902Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117591955111727676", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "827e343c-0783-4fce-8a86-6858901dc670", "content": "CVE-2026-112136  A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112136https://cert-portal.siemens.com/productcert/html/ssa-710379.html#Siemens #MendixStudioPro11 #MendixStudioPro11.12#CVE_2026_112136#bot", "url": "https://infosec.exchange/users/cve/statuses/117591955111727676"}, {"timestamp": "2026-11-10T12:17:16Z", "date_only": false, "value": "2026-11-10T12:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6M57-VRCV-V9J4", "record": "GHSA-6M57-VRCV-V9J4", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T12:17:16.540Z", "date_only": false, "value": "2026-11-10T12:17:16.540", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112136", "record": "FKIE_CVE-2026-112136", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T12:31:49Z", "date_only": false, "value": "2026-11-10T12:31:49Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6M57-VRCV-V9J4", "record": "GHSA-6M57-VRCV-V9J4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T12:31:49Z", "date_only": false, "value": "2026-11-10T12:31:49Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6M57-VRCV-V9J4", "record": "GHSA-6M57-VRCV-V9J4", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T12:50:03.375Z", "date_only": false, "value": "2026-11-10T12:50:03.375044Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzxi47hzzq2n", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "f83d5b39-4755-43de-91e0-881444f760a9", "content": "CVE-2026-112136\nCertain versions of Mendix Studio Pro do not limit the MCP Server\u2019s web listener to the local computer. As a result, anyone on the same network could connect to the server and interact with it. Update to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzxi47hzzq2n"}, {"timestamp": "2026-11-10T14:07:14.734Z", "date_only": false, "value": "2026-11-10T14:07:14.734725Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzxmgaf46t2m", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "8d89781d-ae77-4d04-a746-93532d5b7d29", "content": "\ud83d\udea8 CVE-2026-112136 \u2014 CVSS 9.2 CRITICAL\n\nA vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix S...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-112136\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzxmgaf46t2m"}, {"timestamp": "2026-11-10T16:34:00.788Z", "date_only": false, "value": "2026-11-10T16:34:00.788095Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112136", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-10T16:34:00.788Z", "date_only": false, "value": "2026-11-10T16:34:00.788095Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112136", "record": "FKIE_CVE-2026-112136", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-10T16:34:11.685Z", "date_only": false, "value": "2026-11-10T16:34:11.685Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112136", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T16:34:11.685Z", "date_only": false, "value": "2026-11-10T16:34:11.685Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112136", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T17:17:20.530Z", "date_only": false, "value": "2026-11-10T17:17:20.530", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112136", "record": "FKIE_CVE-2026-112136", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T17:18:50.850Z", "date_only": false, "value": "2026-11-10T17:18:50.850785Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aisecguru.bsky.social/post/3mzxx4tpawi2a", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "2861b24b-f9e7-4753-a5a9-f6839f60cc5e", "content": "Critical Mendix Studio Pro flaw (CVE-2026-112136, CVSS v4 9.2): its MCP server isn't bound to loopback, so anyone reaching port 7782 can drive it and its tools. A CSRF bug lets web pages hit it too. Update to 11.16.0 or 11.12.7. https://cert-portal.siemens.com/productcert/html/ssa-710379.html", "url": "https://bsky.app/profile/aisecguru.bsky.social/post/3mzxx4tpawi2a"}, {"timestamp": "2026-11-11T05:13:56.928Z", "date_only": false, "value": "2026-11-11T05:13:56.928905Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzz73k5jmb2j", "record": "CVE-2026-112136", "field": "creation_timestamp", "uuid": "1d6fa9eb-25c0-4050-829b-65a52826556b", "content": "Siemens Mendix Studio Pro 11 CVE-2026-112136 is rated critical, CVSS 9.2. A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 <\u2026 No public exploit reported yet. Check your exposure. #CVE #PatchManagement\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzz73k5jmb2j"}, {"timestamp": "2026-11-11T10:15:57.755Z", "date_only": false, "value": "2026-11-11T10:15:57.755952Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0479", "record": "NCSC-2026-0479", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T10:15:57.755Z", "date_only": false, "value": "2026-11-11T10:15:57.755952Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0479", "record": "NCSC-2026-0479", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T10:15:57.755Z", "date_only": false, "value": "2026-11-11T10:15:57.755952Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0479", "record": "NCSC-2026-0479", "field": "document.tracking.current_release_date", "linked_record": true}], "metrics": {"as_of": "2026-11-12T16:29:56.423Z", "anchors": {"origin": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 232196.42328, "hours": 64.49900646666666, "days": 2.687458602777778, "min_seconds": 145796.42328, "max_seconds": 232196.42328, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-710379", "record": "SSA-710379", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-12T16:29:56.423Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}