{"metadata": {"vulnerability": "CVE-2025-51591", "count": 36, "kinds": {"milestone": 5, "sighting": 22, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2025-06-16T00:00:00Z", "date_only": false, "value": "2025-06-16T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-07-11T00:00:00Z", "date_only": false, "value": "2025-07-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-07-11T13:45:26.095Z", "date_only": false, "value": "2025-07-11T13:45:26.095352Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114834900611046360", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "b5044332-7e70-4005-93e6-2fb657ff02c5", "url": "https://infosec.exchange/users/cR0w/statuses/114834900611046360"}, {"timestamp": "2025-07-11T14:15:00Z", "date_only": false, "value": "2025-07-11T14:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2025-51591", "record": "UBUNTU-CVE-2025-51591", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-07-11T14:15:27Z", "date_only": false, "value": "2025-07-11T14:15:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MCV3-CH54-XQFH", "record": "GHSA-MCV3-CH54-XQFH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-07-11T14:15:27.347Z", "date_only": false, "value": "2025-07-11T14:15:27.347", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-51591", "record": "FKIE_CVE-2025-51591", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-07-11T15:31:36Z", "date_only": false, "value": "2025-07-11T15:31:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MCV3-CH54-XQFH", "record": "GHSA-MCV3-CH54-XQFH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-09-24T05:15:00Z", "date_only": false, "value": "2025-09-24T05:15:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "a0411e74-0ba0-4624-859d-7e8eec507f29", "url": "https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html"}, {"timestamp": "2025-09-24T07:24:27Z", "date_only": false, "value": "2025-09-24T07:24:27.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/7587", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "63f89341-dd0c-4d88-a86b-6a27085290c3", "content": "\ud83d\udea8 Researchers spotted real-world attacks exploiting a Linux flaw (CVE-2025-51591) in Pandoc to target AWS EC2 IMDS and steal IAM creds.\n\nIf you\u2019re still on IMDSv1, you\u2019re a sitting duck. Enforce IMDSv2 & sandbox Pandoc.\n\nDetails \u2192 https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html", "url": "https://t.me/thehackernews/7587", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-24T07:30:33Z", "date_only": false, "value": "2025-09-24T07:30:33.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/DarkWebInformer_News/8774", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "f8a9d722-cb7b-48ea-9ce2-6a787970b927", "content": "\ud83d\udea8 News Alert!\n\nSource: The Hacker News\nTitle: Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials\nLink: https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html", "url": "https://t.me/DarkWebInformer_News/8774", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-24T07:32:20.076Z", "date_only": false, "value": "2025-09-24T07:32:20.076470Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecindustry.bsky.social/post/3lzkwark2pe2b", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "e5e0e700-4640-43e7-8f7f-38a857261d37", "url": "https://bsky.app/profile/infosecindustry.bsky.social/post/3lzkwark2pe2b"}, {"timestamp": "2025-09-24T07:37:09.555Z", "date_only": false, "value": "2025-09-24T07:37:09.555979Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3lzkwjfa6tk2j", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "2689bf0c-2180-4755-8b63-799d97d6e7af", "url": "https://bsky.app/profile/ninjaowl.ai/post/3lzkwjfa6tk2j"}, {"timestamp": "2025-09-24T07:39:18.446Z", "date_only": false, "value": "2025-09-24T07:39:18.446711Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lzkwn7na3c2m", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "6ee0577a-c165-4c38-9e7a-10e0ec0bdbe8", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lzkwn7na3c2m"}, {"timestamp": "2025-09-24T07:55:04.275Z", "date_only": false, "value": "2025-09-24T07:55:04.275008Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lzkxjd4y35u2", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "c72e351b-f275-430e-8e47-198df58d6938", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lzkxjd4y35u2"}, {"timestamp": "2025-09-24T08:04:13Z", "date_only": false, "value": "2025-09-24T08:04:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/16374", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "fa56a70e-facb-45d4-b84a-69a3bc5fa0fa", "content": "Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials \u2013 thehackernews.com\n\nWed, 24 Sep 2025 15:15:00", "url": "https://t.me/MalaysiaHacktivistz/16374", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-24T11:00:15Z", "date_only": false, "value": "2025-09-24T11:00:15.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/PYmlawexHpayo7N6DA7Y4t3g_HuggkSbrRqXIyNnjJemkQ", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "356bafc7-c4db-49ea-b62d-08087c96e207", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-24T11:05:21.578Z", "date_only": false, "value": "2025-09-24T11:05:21.578399Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/jbhall56/statuses/115258944463443370", "record": "cve-2025-51591", "field": "creation_timestamp", "uuid": "1129863a-39e6-44dd-be43-b5fac1134b85", "url": "https://infosec.exchange/users/jbhall56/statuses/115258944463443370"}, {"timestamp": "2025-09-24T15:31:12Z", "date_only": false, "value": "2025-09-24T15:31:12Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MCV3-CH54-XQFH", "record": "GHSA-MCV3-CH54-XQFH", "field": "modified", "linked_record": true}, {"timestamp": "2025-09-24T21:12:01.544Z", "date_only": false, "value": "2025-09-24T21:12:01.544937Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/115261329948706142", "record": "cve-2025-51591", "field": "creation_timestamp", "uuid": "70270433-287f-4fbe-be2b-55dd7a9bedf0", "url": "https://infosec.exchange/users/patrickcmiller/statuses/115261329948706142"}, {"timestamp": "2025-09-25T03:00:40Z", "date_only": false, "value": "2025-09-25T03:00:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xNi-QJgTYNVGvsNmT_0iHQRJgkuu3lNU-CAGjEVqosCwtg", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "fd954721-7c6b-42c7-aebb-4ec8f2875867", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-25T04:29:53Z", "date_only": false, "value": "2025-09-25T04:29:53.000000Z", "kind": "sighting", "label": "Seen", "source": "https://sploitus.com/exploit?id=9F3A9BDC-91E5-5753-AFCD-9F412A964DF0&utm_source=rss&utm_medium=rss", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "02fab820-ce88-4ebf-8bf3-16626b3ca33f", "url": "https://sploitus.com/exploit?id=9F3A9BDC-91E5-5753-AFCD-9F412A964DF0&utm_source=rss&utm_medium=rss"}, {"timestamp": "2025-09-25T11:21:55Z", "date_only": false, "value": "2025-09-25T11:21:55.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/53034", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "fe5fa5d8-c683-467c-8105-e50095fa3099", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-51591 Pandoc SSRF vulnerability Proof of Concept\nURL\uff1ahttps://github.com/Malayke/CVE-2022-35583-Pandoc-SSRF-POC\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/53034", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-25T11:28:26Z", "date_only": false, "value": "2025-09-25T11:28:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/53035", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "92052c75-f54a-4571-bb43-3c7419834c42", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-51591 Pandoc SSRF vulnerability Proof of Concept\nURL\uff1ahttps://github.com/Malayke/CVE-2025-51591-Pandoc-SSRF-POC\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/53035", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-25T15:00:07Z", "date_only": false, "value": "2025-09-25T15:00:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/63Ywe12gnG7E1mjEm9qBRIXWQLRqnA7nYz9eO9WBeT2jKPw", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "18f66e42-c9ed-47b2-aa3d-7817976321dc", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-25T15:00:10Z", "date_only": false, "value": "2025-09-25T15:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FtrZgkpLeYmB_Gzr3BO-OhU7P_MnBX2TUcQYinIY1IaRYFs", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "e09cdf76-e1ca-46cf-aa9d-a9b8da3fb3ed", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-27T21:02:31.755Z", "date_only": false, "value": "2025-09-27T21:02:31.755825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lztuw3pudc2j", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "2daf78ac-f8d6-4098-9f2a-2152bd459c59", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lztuw3pudc2j"}, {"timestamp": "2025-10-07T15:56:45.462Z", "date_only": false, "value": "2025-10-07T15:56:45.462102Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-51591", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2025-10-07T15:56:45.462Z", "date_only": false, "value": "2025-10-07T15:56:45.462102Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-51591", "record": "FKIE_CVE-2025-51591", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-11-17T16:56:24.240Z", "date_only": false, "value": "2025-11-17T16:56:24.240Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-51591", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-19T12:45:52.896Z", "date_only": false, "value": "2026-06-19T12:45:52.896587Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a3e5a22a-195a-4198-9954-44aaf53ef77b", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "3772c505-76e6-4103-a11c-03649aa37f16", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a3e5a22a-195a-4198-9954-44aaf53ef77b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-05T16:11:02.049Z", "date_only": false, "value": "2026-07-05T16:11:02.049Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-05T16:11:02.049Z", "date_only": false, "value": "2026-07-05T16:11:02.049Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2025-51591", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-05T17:17:15.480Z", "date_only": false, "value": "2026-07-05T17:17:15.480", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-51591", "record": "FKIE_CVE-2025-51591", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-07-20T19:00:06.140Z", "date_only": false, "value": "2026-07-20T19:00:06.140601Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/7317", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "4b0951ea-6734-43c1-a0c3-27b87efd9466", "content": "Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials \u2013 thehackernews.com\n\nWed, 24 Sep 2025 15:15:00", "url": "https://t.me/MalaysiaHacktivistz/7317"}, {"timestamp": "2026-07-22T00:00:30.336Z", "date_only": false, "value": "2026-07-22T00:00:30.336217Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/7317", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "9524e2e1-4748-445b-9282-95fff07d761e", "content": "Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials \u2013 thehackernews.com\n\nWed, 24 Sep 2025 15:15:00", "url": "https://t.me/MalaysiaHacktivistz/7317", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-17T09:36:18Z", "date_only": false, "value": "2026-10-17T09:36:18Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2025-51591", "record": "UBUNTU-CVE-2025-51591", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-12T16:45:04.434Z", "anchors": {"origin": {"timestamp": "2025-07-11T00:00:00Z", "date_only": false, "value": "2025-07-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-07-11T00:00:00Z", "date_only": false, "value": "2025-07-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2025-09-25T03:00:40Z", "date_only": false, "value": "2025-09-25T03:00:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xNi-QJgTYNVGvsNmT_0iHQRJgkuu3lNU-CAGjEVqosCwtg", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "fd954721-7c6b-42c7-aebb-4ec8f2875867", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2025-09-24T07:24:27Z", "date_only": false, "value": "2025-09-24T07:24:27.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/7587", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "63f89341-dd0c-4d88-a86b-6a27085290c3", "content": "\ud83d\udea8 Researchers spotted real-world attacks exploiting a Linux flaw (CVE-2025-51591) in Pandoc to target AWS EC2 IMDS and steal IAM creds.\n\nIf you\u2019re still on IMDSv1, you\u2019re a sitting duck. Enforce IMDSv2 & sandbox Pandoc.\n\nDetails \u2192 https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html", "url": "https://t.me/thehackernews/7587", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 6506667.0, "hours": 1807.4075, "days": 75.30864583333333, "min_seconds": 6420267.0, "max_seconds": 6506667.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-07-11T00:00:00Z", "date_only": false, "value": "2025-07-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-09-24T07:24:27Z", "date_only": false, "value": "2025-09-24T07:24:27.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/7587", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "63f89341-dd0c-4d88-a86b-6a27085290c3", "content": "\ud83d\udea8 Researchers spotted real-world attacks exploiting a Linux flaw (CVE-2025-51591) in Pandoc to target AWS EC2 IMDS and steal IAM creds.\n\nIf you\u2019re still on IMDSv1, you\u2019re a sitting duck. Enforce IMDSv2 & sandbox Pandoc.\n\nDetails \u2192 https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html", "url": "https://t.me/thehackernews/7587", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 6506667.0, "hours": 1807.4075, "days": 75.30864583333333, "min_seconds": 6420267.0, "max_seconds": 6506667.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-07-11T00:00:00Z", "date_only": false, "value": "2025-07-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-09-24T07:24:27Z", "date_only": false, "value": "2025-09-24T07:24:27.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/7587", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "63f89341-dd0c-4d88-a86b-6a27085290c3", "content": "\ud83d\udea8 Researchers spotted real-world attacks exploiting a Linux flaw (CVE-2025-51591) in Pandoc to target AWS EC2 IMDS and steal IAM creds.\n\nIf you\u2019re still on IMDSv1, you\u2019re a sitting duck. Enforce IMDSv2 & sandbox Pandoc.\n\nDetails \u2192 https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html", "url": "https://t.me/thehackernews/7587", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 6577240.0, "hours": 1827.0111111111112, "days": 76.12546296296296, "min_seconds": 6490840.0, "max_seconds": 6577240.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-07-11T00:00:00Z", "date_only": false, "value": "2025-07-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-09-25T03:00:40Z", "date_only": false, "value": "2025-09-25T03:00:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xNi-QJgTYNVGvsNmT_0iHQRJgkuu3lNU-CAGjEVqosCwtg", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "fd954721-7c6b-42c7-aebb-4ec8f2875867", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 42309904.434431, "hours": 11752.75123178639, "days": 489.6979679910996, "min_seconds": 42223504.434431, "max_seconds": 42309904.434431, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-07-11T00:00:00Z", "date_only": false, "value": "2025-07-11T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-51591", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T16:45:04.434Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 35803237.434431, "hours": 9945.34373178639, "days": 414.38932215776623, "min_seconds": 35803237.434431, "max_seconds": 35803237.434431, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-09-24T07:24:27Z", "date_only": false, "value": "2025-09-24T07:24:27.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/7587", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "63f89341-dd0c-4d88-a86b-6a27085290c3", "content": "\ud83d\udea8 Researchers spotted real-world attacks exploiting a Linux flaw (CVE-2025-51591) in Pandoc to target AWS EC2 IMDS and steal IAM creds.\n\nIf you\u2019re still on IMDSv1, you\u2019re a sitting duck. Enforce IMDSv2 & sandbox Pandoc.\n\nDetails \u2192 https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html", "url": "https://t.me/thehackernews/7587", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-12T16:45:04.434Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 35732664.434431, "hours": 9925.740120675278, "days": 413.5725050281366, "min_seconds": 35732664.434431, "max_seconds": 35732664.434431, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-09-25T03:00:40Z", "date_only": false, "value": "2025-09-25T03:00:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xNi-QJgTYNVGvsNmT_0iHQRJgkuu3lNU-CAGjEVqosCwtg", "record": "CVE-2025-51591", "field": "creation_timestamp", "uuid": "fd954721-7c6b-42c7-aebb-4ec8f2875867", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-12T16:45:04.434Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}