{"metadata": {"vulnerability": "CVE-2026-110638", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-08-05T00:00:00Z", "date_only": false, "value": "2026-08-05T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110638", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:32.721Z", "date_only": false, "value": "2026-10-14T13:07:32.721Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110638", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:09.820Z", "date_only": false, "value": "2026-10-14T14:17:09.820Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110638", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:09.820Z", "date_only": false, "value": "2026-10-14T14:17:09.820Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110638", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:16Z", "date_only": false, "value": "2026-10-14T15:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XJWR-PQR4-R7H8", "record": "GHSA-XJWR-PQR4-R7H8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:16.997Z", "date_only": false, "value": "2026-10-14T15:17:16.997", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110638", "record": "FKIE_CVE-2026-110638", "field": "published"}, {"timestamp": "2026-10-14T15:32:27Z", "date_only": false, "value": "2026-10-14T15:32:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XJWR-PQR4-R7H8", "record": "GHSA-XJWR-PQR4-R7H8", "field": "published"}, {"timestamp": "2026-10-14T15:32:27Z", "date_only": false, "value": "2026-10-14T15:32:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XJWR-PQR4-R7H8", "record": "GHSA-XJWR-PQR4-R7H8", "field": "modified"}, {"timestamp": "2026-10-14T16:00:05.785Z", "date_only": false, "value": "2026-10-14T16:00:05.785431Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtw5673zg2n", "record": "CVE-2026-110638", "field": "creation_timestamp", "uuid": "83cea935-913f-49d4-bb9a-d33918a01331", "content": "CVE-2026-110638 - doc-recog\nThe doc-recog library up to version 1.1.6 lets an attacker place special characters in a document name, causing the program to run that command on the server. This happens\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#docrecog #zepspaiva #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtw5673zg2n"}, {"timestamp": "2026-10-14T16:09:14.279Z", "date_only": false, "value": "2026-10-14T16:09:14.279264Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwnjl7lf2n", "record": "CVE-2026-110638", "field": "creation_timestamp", "uuid": "b701105c-2478-4ac5-8d9f-4776c46ba439", "content": "\ud83d\udea8 CVE-2026-110638 \u2014 CVSS 9.3 CRITICAL\n\ndoc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute com...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110638\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwnjl7lf2n"}, {"timestamp": "2026-10-14T19:40:49.101Z", "date_only": false, "value": "2026-10-14T19:40:49.101904Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440960828938998", "record": "CVE-2026-110638", "field": "creation_timestamp", "uuid": "f1d3fcce-2fe3-4db0-9be4-39a444f51cd0", "content": "CVE-2026-110638 doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110638https://github.com/zepspaiva/doc-recog/pull/2https://github.com/zepspaiva/doc-recog/blob/96d31957fbc2a31f1d739e2d64e5c85a05f688ec/docdata.js#L69-L74https://github.com/zepspaiva/doc-recoghttps://www.vulncheck.com/advisories/doc-recog-through-1.1.6-os-command-injection-via-docdata-readpdf-file-path#zepspaiva #doc-recog#CVE_2026_110638#bot", "url": "https://infosec.exchange/users/cve/statuses/117440960828938998"}, {"timestamp": "2026-10-16T16:48:49.883Z", "date_only": false, "value": "2026-10-16T16:48:49.883600Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110638", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:48:49.883Z", "date_only": false, "value": "2026-10-16T16:48:49.883600Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110638", "record": "FKIE_CVE-2026-110638", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T17:15:54.950Z", "date_only": false, "value": "2026-10-16T17:15:54.950Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110638", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:15:54.950Z", "date_only": false, "value": "2026-10-16T17:15:54.950Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110638", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:03:18.127Z", "date_only": false, "value": "2026-10-16T19:03:18.127", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110638", "record": "FKIE_CVE-2026-110638", "field": "lastModified"}]}