{"metadata": {"vulnerability": "CVE-2026-100382", "count": 27, "kinds": {"milestone": 4, "sighting": 10, "kev": 5, "other": 8}}, "data": [{"timestamp": "2026-09-25T19:28:16.149Z", "date_only": false, "value": "2026-09-25T19:28:16.149Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-100382", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-25T21:04:02.848Z", "date_only": false, "value": "2026-09-25T21:04:02.848Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100382", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-25T21:04:02.848Z", "date_only": false, "value": "2026-09-25T21:04:02.848Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / wikimedia-foundation", "record": "CVE-2026-100382", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-25T22:17:10Z", "date_only": false, "value": "2026-09-25T22:17:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VWH3-JQ98-4W28", "record": "GHSA-VWH3-JQ98-4W28", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-25T22:17:10.150Z", "date_only": false, "value": "2026-09-25T22:17:10.150", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100382", "record": "FKIE_CVE-2026-100382", "field": "published"}, {"timestamp": "2026-09-26T00:00:32Z", "date_only": false, "value": "2026-09-26T00:00:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/6ea92f5d3523919a824d2395951afa6c", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "47fb435d-e03d-4352-b57c-d606553f40e7", "content": "This daily cyber threat intelligence digest highlights three critical software vulnerabilities, a major legal sentencing, and one non-security community post. Key takeaways:\n\n\u2022 **MediaWiki (CVE-2026-100382):** Critical (CVSS 10.0) unauthenticated RCE via OS command injection in the ExternalData extension (v<3.7).  \n\u2022 **WordPress (AV26-952):** Critical path traversal in page-template resolution enabling conditional RCE in versions <7.1.2. The flaw is actively exploited in the wild and has been added to CISA\u2019s KEV database; immediate patching is required.  \n\u2022 **CliInvoke.Specializations (CVE-2026-100368):** High (CVSS 8.4) command injection in PowerShell/Cmd wrappers caused by improper handling of untrusted arguments containing double quotes. Patched versions and mitigation workarounds are available.  \n\u2022 **Legal/Incident:** A U.S. Army soldier received a 70-month prison sentence and ~$300K in restitution for hacking AT&T and Verizon to steal mobile metadata, impacting over 100 million customers.  \n\u2022 **Non-Technical:** The digest also includes a community event recommendation for a family squid dissection in Tennessee.  \n\n**Overall:** Organizations should prioritize patching MediaWiki, WordPress, and CliInvoke components, while the sentencing underscores ongoing insider threats targeting critical telecom infrastructure.", "url": "https://gist.github.com/ichintu/6ea92f5d3523919a824d2395951afa6c"}, {"timestamp": "2026-09-26T00:00:37.958Z", "date_only": false, "value": "2026-09-26T00:00:37.958876Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117334398532334299", "record": "cve-2026-100382", "field": "creation_timestamp", "uuid": "30f06ba1-d6ea-4932-9890-d2e83adfdfb5", "content": "CVE-2026-100382 (CRITICAL, CVSS 10): Wikimedia Mediawiki ExternalData Extension (<3.7) suffers OS Command Injection. Remote, unauthenticated code execution is possible. Restrict access & monitor systems. Details: https://radar.offseq.com/threat/cve-2026-100382-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-75689d73ee2acd97 #OffSeq #CVE2026100382 #infosec #Mediawiki", "url": "https://infosec.exchange/users/offseq/statuses/117334398532334299"}, {"timestamp": "2026-09-26T00:00:39.841Z", "date_only": false, "value": "2026-09-26T00:00:39.841304Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwey4y6xt62q", "record": "cve-2026-100382", "field": "creation_timestamp", "uuid": "0ba067de-79b1-4d5f-9721-64e7a1dadb80", "content": "CVE-2026-100382: CRITICAL OS Command Injection in Mediawiki ExternalData Extension (<3.7). Remote attackers can run arbitrary commands. Restrict access & monitor for signs of compromise. https://radar.offseq.com/threat/cve-2026-100382-cwe-78-improper-neutralization-of-special-elements-used-in-an-...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mwey4y6xt62q"}, {"timestamp": "2026-09-26T00:07:32.256Z", "date_only": false, "value": "2026-09-26T00:07:32.256525Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mweyjccx4n2q", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "a286ba8e-6a19-4c7c-8e60-06122fee3ae5", "content": "\ud83d\udea8 CVE-2026-100382 \u2014 CVSS 10 CRITICAL\n\nImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100382\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mweyjccx4n2q"}, {"timestamp": "2026-09-26T00:32:18Z", "date_only": false, "value": "2026-09-26T00:32:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VWH3-JQ98-4W28", "record": "GHSA-VWH3-JQ98-4W28", "field": "published"}, {"timestamp": "2026-09-26T00:32:18Z", "date_only": false, "value": "2026-09-26T00:32:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VWH3-JQ98-4W28", "record": "GHSA-VWH3-JQ98-4W28", "field": "modified"}, {"timestamp": "2026-09-26T09:00:24.231Z", "date_only": false, "value": "2026-09-26T09:00:24.231763Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117336521016931097", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "72d0d078-c8dd-4197-9542-e72605358212", "content": "Mediawiki ExternalData Extension <3.7 has a CRITICAL OS Command Injection vuln (CVE-2026-100382). Unauthenticated attackers could run arbitrary OS commands. No exploits yet. Restrict access, monitor activity. https://radar.offseq.com/threat/improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-b27f1e4f9d070501 #OffSeq #CVE2026100382 #Mediawiki #Security", "url": "https://infosec.exchange/users/offseq/statuses/117336521016931097"}, {"timestamp": "2026-09-26T16:00:04.700Z", "date_only": false, "value": "2026-09-26T16:00:04.700078Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgnqkqw3k26", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "bb638bde-8e40-4165-9681-65dfb86b074b", "content": "CVE-2026-100382 - mediawiki - externaldata extension\nThe ExternalData add\u2011on for Mediawiki can be tricked into executing system commands without any authentication. This means an attacker could run\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wikimediafoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgnqkqw3k26"}, {"timestamp": "2026-09-26T22:43:20.551Z", "date_only": false, "value": "2026-09-26T22:43:20.551535Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100382", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-26T22:43:20.551Z", "date_only": false, "value": "2026-09-26T22:43:20.551535Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100382", "record": "FKIE_CVE-2026-100382", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-26T22:51:17.735Z", "date_only": false, "value": "2026-09-26T22:51:17.735Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-100382", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-26T22:51:17.735Z", "date_only": false, "value": "2026-09-26T22:51:17.735Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100382", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-27T19:00:15Z", "date_only": false, "value": "2026-09-27T19:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xW8z4oUOq-Ane7EXj1wNqp6zyl2_0CSzOhfXQFSSmteKMQE", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "830fe099-2562-4cd0-975f-e27dbf2e54ad"}, {"timestamp": "2026-09-27T19:00:15Z", "date_only": false, "value": "2026-09-27T19:00:15.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/xW8z4oUOq-Ane7EXj1wNqp6zyl2_0CSzOhfXQFSSmteKMQE", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "02a18407-ca6f-4be7-9379-a721cdbff42e"}, {"timestamp": "2026-09-28T16:38:10.183Z", "date_only": false, "value": "2026-09-28T16:38:10.183", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100382", "record": "FKIE_CVE-2026-100382", "field": "lastModified"}, {"timestamp": "2026-10-01T03:30:27.622Z", "date_only": false, "value": "2026-10-01T03:30:27.622771Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwrw6qtxfk2t", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "b5e8589d-0d12-46ce-9e4c-e0c4a8f4df3b", "content": "Attackers exploit CVE-2026-100382, a CVSS 10 unauthenticated MediaWiki RCE in External Data. PoC is public. Upgrade to 3.7 now.\n\n#MediaWiki #ExternalData #CVE2026100382 #RCE #CommandInjection #ExploitedInTheWild #PoC", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwrw6qtxfk2t"}, {"timestamp": "2026-10-01T09:43:00Z", "date_only": false, "value": "2026-10-01T09:43:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-100382", "field": "timestamps.asserted_at", "uuid": "67178a7a-26a9-4107-b0b6-88b1053a340d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-01T09:43:00Z", "date_only": false, "value": "2026-10-01T09:43:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-100382", "field": "evidence.0.details.added_date", "uuid": "67178a7a-26a9-4107-b0b6-88b1053a340d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-01T09:43:00Z", "date_only": false, "value": "2026-10-01T09:43:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-100382", "field": "timestamps.first_seen_at", "uuid": "67178a7a-26a9-4107-b0b6-88b1053a340d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-01T09:43:00Z", "date_only": false, "value": "2026-10-01T09:43:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-100382", "field": "status.status_updated_at", "uuid": "67178a7a-26a9-4107-b0b6-88b1053a340d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-02T10:00:01Z", "date_only": false, "value": "2026-10-02T10:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-100382", "field": "timestamps.recorded_at", "uuid": "67178a7a-26a9-4107-b0b6-88b1053a340d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-02T10:00:41.724Z", "date_only": false, "value": "2026-10-02T10:00:41.724155Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/67178a7a-26a9-4107-b0b6-88b1053a340d", "record": "CVE-2026-100382", "field": "creation_timestamp", "uuid": "43581cf5-4eaf-462b-86bd-763be1b1bbb3", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/67178a7a-26a9-4107-b0b6-88b1053a340d"}]}