{"metadata": {"vulnerability": "CVE-2026-67595", "count": 24, "kinds": {"milestone": 4, "sighting": 6, "kev": 5, "other": 9}}, "data": [{"timestamp": "2026-03-30T00:00:00Z", "date_only": false, "value": "2026-03-30T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-67595", "field": "containers.cna.datePublic"}, {"timestamp": "2026-07-29T21:07:39.201Z", "date_only": false, "value": "2026-07-29T21:07:39.201Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-67595", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-29T21:33:25.952Z", "date_only": false, "value": "2026-07-29T21:33:25.952Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67595", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-29T22:16:52Z", "date_only": false, "value": "2026-07-29T22:16:52Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M2CX-9W9F-2HM7", "record": "GHSA-M2CX-9W9F-2HM7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-29T22:16:52.667Z", "date_only": false, "value": "2026-07-29T22:16:52.667", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67595", "record": "FKIE_CVE-2026-67595", "field": "published"}, {"timestamp": "2026-07-29T22:50:15.033Z", "date_only": false, "value": "2026-07-29T22:50:15.033621Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsz5fry6g2u", "record": "CVE-2026-67595", "field": "creation_timestamp", "uuid": "d5d1df99-0fcd-4b00-a404-3b4f6b4643c5", "content": "CVE-2026-67595\nVaahCMS versions 2.0.0 to 2.3.4 have a security flaw in their email system that could allow hackers to steal passwords from users who open a malicious email in their browser. This means that anyone using these\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsz5fry6g2u"}, {"timestamp": "2026-07-29T23:59:57.894Z", "date_only": false, "value": "2026-07-29T23:59:57.894861Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrt52dd6wg2c", "record": "CVE-2026-67595", "field": "creation_timestamp", "uuid": "94e1651c-d4cc-4637-a821-3cba24f0f840", "content": "\ud83d\udfe0 CVE-2026-67595 - High (8.1)\n\nVaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded i...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67595/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrt52dd6wg2c"}, {"timestamp": "2026-07-30T00:00:38.645Z", "date_only": false, "value": "2026-07-30T00:00:38.645654Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrt53khbxv2t", "record": "cve-2026-67595", "field": "creation_timestamp", "uuid": "eb8ed76d-1ab8-4b12-b453-9318f1d5c763", "content": "VaahCMS 2.0.0 \u2013 2.3.4 hit by CRITICAL vuln: OTP email templates contain malicious JS enabling code execution, keylogging, & C2. Avoid JS-enabled email rendering. Await vendor patch. https://radar.offseq.com/threat/cve-2026-67595-embedded-malicious-code-in-webreinvent-vaahcms-94fc0638a0fe22eb #Off...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mrt53khbxv2t"}, {"timestamp": "2026-07-30T00:31:19Z", "date_only": false, "value": "2026-07-30T00:31:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M2CX-9W9F-2HM7", "record": "GHSA-M2CX-9W9F-2HM7", "field": "published"}, {"timestamp": "2026-07-30T00:31:19Z", "date_only": false, "value": "2026-07-30T00:31:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M2CX-9W9F-2HM7", "record": "GHSA-M2CX-9W9F-2HM7", "field": "modified"}, {"timestamp": "2026-07-30T14:21:35.095Z", "date_only": false, "value": "2026-07-30T14:21:35.095590Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-67595", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-30T14:21:35.095Z", "date_only": false, "value": "2026-07-30T14:21:35.095590Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67595", "record": "FKIE_CVE-2026-67595", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-30T15:17:56.308Z", "date_only": false, "value": "2026-07-30T15:17:56.308Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-67595", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-01T04:30:03.717Z", "date_only": false, "value": "2026-08-01T04:30:03.717269Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mryn35w7dr2h", "record": "CVE-2026-67595", "field": "creation_timestamp", "uuid": "063c281c-5aa8-4583-8d95-d222893bf493", "content": "CVE-2026-67595\nVaahCMS versions 2.0.0 through 2.3.4 contain a security risk in their OTP email feature. If a user with JavaScript enabled receives a malicious email, it can secretly install a keylogger and capture sensitive\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mryn35w7dr2h"}, {"timestamp": "2026-08-02T06:08:45.838Z", "date_only": false, "value": "2026-08-02T06:08:45.838987Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/LkH85X-JUMEtHWq9ccTX7RdLtAYJyJlmaTWlNzBdkhBs1mA", "record": "CVE-2026-67595", "field": "creation_timestamp", "uuid": "d994f91c-d52e-42d1-8d58-36ecb7fdba59"}, {"timestamp": "2026-08-14T17:12:30Z", "date_only": false, "value": "2026-08-14T17:12:30+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-67595", "field": "timestamps.asserted_at", "uuid": "696b6365-288a-47ad-a0ee-7d3dd207ff1b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-14T17:12:30Z", "date_only": false, "value": "2026-08-14T17:12:30+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-67595", "field": "timestamps.first_seen_at", "uuid": "696b6365-288a-47ad-a0ee-7d3dd207ff1b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-14T17:12:30Z", "date_only": false, "value": "2026-08-14T17:12:30+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-67595", "field": "status.status_updated_at", "uuid": "696b6365-288a-47ad-a0ee-7d3dd207ff1b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-14T17:12:30.387Z", "date_only": false, "value": "2026-08-14T17:12:30.387Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-67595", "field": "evidence.0.details.added_date", "uuid": "696b6365-288a-47ad-a0ee-7d3dd207ff1b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-14T18:00:01Z", "date_only": false, "value": "2026-08-14T18:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-67595", "field": "timestamps.recorded_at", "uuid": "696b6365-288a-47ad-a0ee-7d3dd207ff1b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-14T18:00:21.169Z", "date_only": false, "value": "2026-08-14T18:00:21.169364Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/696b6365-288a-47ad-a0ee-7d3dd207ff1b", "record": "CVE-2026-67595", "field": "creation_timestamp", "uuid": "e4dc764a-2f53-4ebf-8f95-8ad1045e2dab", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/696b6365-288a-47ad-a0ee-7d3dd207ff1b"}, {"timestamp": "2026-09-24T14:18:27.621Z", "date_only": false, "value": "2026-09-24T14:18:27.621Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-67595", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-24T14:18:27.621Z", "date_only": false, "value": "2026-09-24T14:18:27.621Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-67595", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-24T13:10:00.147Z", "date_only": false, "value": "2026-10-24T13:10:00.147", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67595", "record": "FKIE_CVE-2026-67595", "field": "lastModified"}]}