{"metadata": {"vulnerability": "CVE-2026-119418", "count": 20, "kinds": {"milestone": 5, "sighting": 5, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119418", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T02:41:11.515Z", "date_only": false, "value": "2026-10-30T02:41:11.515Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119418", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T11:30:50.158Z", "date_only": false, "value": "2026-10-30T11:30:50.158Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119418", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T11:30:50.158Z", "date_only": false, "value": "2026-10-30T11:30:50.158Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119418", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T11:46:02.188Z", "date_only": false, "value": "2026-10-30T11:46:02.188876Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117529690873932141", "record": "CVE-2026-119418", "field": "creation_timestamp", "uuid": "b45ceae1-e178-4d92-971b-d35d7a39d298", "content": "CVE-2026-119418 CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119418https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1fhttps://github.com/cakephp/cakephp/pull/19735https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330https://abraxaslabs.tech/research/cakephp-window-sqlihttps://github.com/cakephp/cakephphttps://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame#cakephp#CVE_2026_119418#bot", "url": "https://infosec.exchange/users/cve/statuses/117529690873932141"}, {"timestamp": "2026-10-30T12:16:38Z", "date_only": false, "value": "2026-10-30T12:16:38Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-H3R5-88VP-3QM7", "record": "GHSA-H3R5-88VP-3QM7", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-30T12:16:38.390Z", "date_only": false, "value": "2026-10-30T12:16:38.390", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119418", "record": "FKIE_CVE-2026-119418", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:31:18Z", "date_only": false, "value": "2026-10-30T12:31:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H3R5-88VP-3QM7", "record": "GHSA-H3R5-88VP-3QM7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:31:18Z", "date_only": false, "value": "2026-10-30T12:31:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H3R5-88VP-3QM7", "record": "GHSA-H3R5-88VP-3QM7", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T13:00:06.242Z", "date_only": false, "value": "2026-10-30T13:00:06.242321Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz3tk2hy6t2w", "record": "CVE-2026-119418", "field": "creation_timestamp", "uuid": "de13d448-f381-4c9b-b9a3-7692c97ec578", "content": "CVE-2026-119418 - cakephp\nIf you use CakePHP version 5.4.3 or earlier, a flaw lets a malicious user embed crafted values that are passed to database queries. This can cause the attacker to execute arbitrary SQL\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cakephp #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz3tk2hy6t2w"}, {"timestamp": "2026-10-30T14:07:18.785Z", "date_only": false, "value": "2026-10-30T14:07:18.785121Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz3xc7wpfo25", "record": "CVE-2026-119418", "field": "creation_timestamp", "uuid": "9a88b6b7-23eb-4bb6-a66c-21f36c3ec5f6", "content": "\ud83d\udea8 CVE-2026-119418 \u2014 CVSS 9.2 CRITICAL\n\nCakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supply...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-119418\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz3xc7wpfo25"}, {"timestamp": "2026-10-30T16:03:58.022Z", "date_only": false, "value": "2026-10-30T16:03:58.022834Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119418", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-30T16:03:58.022Z", "date_only": false, "value": "2026-10-30T16:03:58.022834Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119418", "record": "FKIE_CVE-2026-119418", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-30T16:04:14.569Z", "date_only": false, "value": "2026-10-30T16:04:14.569Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119418", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T16:04:14.569Z", "date_only": false, "value": "2026-10-30T16:04:14.569Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119418", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T16:31:08.148Z", "date_only": false, "value": "2026-10-30T16:31:08.148959Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/65xrh5iudgjeo", "record": "CVE-2026-119418", "field": "creation_timestamp", "uuid": "63b16559-a65f-4868-aaa1-794f17ce29ab", "content": "\ud83d\udea8 CVE-2026-119418\nAffected product: see description\nCVSS 9.2 / KEV: No\nTL;DR: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets an\u2026\nhttps://cvesentinel.com/report/CVE-2026-119418\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/65xrh5iudgjeo"}, {"timestamp": "2026-10-30T19:07:25.060Z", "date_only": false, "value": "2026-10-30T19:07:25.060", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119418", "record": "FKIE_CVE-2026-119418", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-02T16:37:48.229Z", "date_only": false, "value": "2026-11-02T16:37:48.229474Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzdr43orzj2d", "record": "CVE-2026-119418", "field": "creation_timestamp", "uuid": "362926a5-b115-47d5-8181-8cc8593600df", "content": "New critical vulnerability in cakephp: CVE-2026-119418, CVSS 9.2. CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying\u2026 No public exploit reported yet. #CVE #vulnerability\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzdr43orzj2d"}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119418", "record": "UBUNTU-CVE-2026-119418", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119418", "record": "UBUNTU-CVE-2026-119418", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T05:02:22.246Z", "anchors": {"origin": {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119418", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119418", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2091742.246471, "hours": 581.0395129086111, "days": 24.209979704525463, "min_seconds": 2005342.246471, "max_seconds": 2091742.246471, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119418", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T05:02:22.246Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}