{"metadata": {"vulnerability": "CVE-2026-110636", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-07-02T00:00:00Z", "date_only": false, "value": "2026-07-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110636", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:32.089Z", "date_only": false, "value": "2026-10-14T13:07:32.089Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110636", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:08.465Z", "date_only": false, "value": "2026-10-14T14:17:08.465Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110636", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:08.465Z", "date_only": false, "value": "2026-10-14T14:17:08.465Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110636", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:16Z", "date_only": false, "value": "2026-10-14T15:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HX4X-JQ2F-PWR6", "record": "GHSA-HX4X-JQ2F-PWR6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:16.710Z", "date_only": false, "value": "2026-10-14T15:17:16.710", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110636", "record": "FKIE_CVE-2026-110636", "field": "published"}, {"timestamp": "2026-10-14T15:32:27Z", "date_only": false, "value": "2026-10-14T15:32:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HX4X-JQ2F-PWR6", "record": "GHSA-HX4X-JQ2F-PWR6", "field": "published"}, {"timestamp": "2026-10-14T15:32:27Z", "date_only": false, "value": "2026-10-14T15:32:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HX4X-JQ2F-PWR6", "record": "GHSA-HX4X-JQ2F-PWR6", "field": "modified"}, {"timestamp": "2026-10-14T15:50:06.361Z", "date_only": false, "value": "2026-10-14T15:50:06.361197Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtvlcnump2q", "record": "CVE-2026-110636", "field": "creation_timestamp", "uuid": "a73ea6bb-b195-4e46-acae-97a3d4f830c4", "content": "CVE-2026-110636 - pypdftk\nThe Python library revolunet/pypdftk builds shell commands using file paths you provide. If an attacker can control the PDF file name or output file name, they can insert special\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#pypdftk #revolunet #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtvlcnump2q"}, {"timestamp": "2026-10-14T16:09:05.790Z", "date_only": false, "value": "2026-10-14T16:09:05.790757Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwnbhhhv2z", "record": "CVE-2026-110636", "field": "creation_timestamp", "uuid": "33ffa7e4-4124-44ef-862a-714fc747ea81", "content": "\ud83d\udea8 CVE-2026-110636 \u2014 CVSS 9.3 CRITICAL\n\npypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110636\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwnbhhhv2z"}, {"timestamp": "2026-10-14T19:39:28.601Z", "date_only": false, "value": "2026-10-14T19:39:28.601723Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440955542610920", "record": "CVE-2026-110636", "field": "creation_timestamp", "uuid": "edf1b402-60f1-4412-aad9-86f557052400", "content": "CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Paths pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110636https://github.com/revolunet/pypdftk/issues/56https://github.com/revolunet/pypdftk/pull/57https://github.com/revolunet/pypdftk/blob/1d3b40c3b42fb3cc6b0192d34aba2c21a1efd369/pypdftk.py#L87-L123https://github.com/revolunet/pypdftkhttps://www.vulncheck.com/advisories/pypdftk-through-0.5-os-command-injection-via-pdf-and-output-paths#revolunet #pypdftk#CVE_2026_110636#bot", "url": "https://infosec.exchange/users/cve/statuses/117440955542610920"}, {"timestamp": "2026-10-20T01:21:04.535Z", "date_only": false, "value": "2026-10-20T01:21:04.535653Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110636", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T01:21:04.535Z", "date_only": false, "value": "2026-10-20T01:21:04.535653Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110636", "record": "FKIE_CVE-2026-110636", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T01:21:31.597Z", "date_only": false, "value": "2026-10-20T01:21:31.597Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110636", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T01:21:31.597Z", "date_only": false, "value": "2026-10-20T01:21:31.597Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110636", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T02:17:09.833Z", "date_only": false, "value": "2026-10-20T02:17:09.833", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110636", "record": "FKIE_CVE-2026-110636", "field": "lastModified"}]}