{"metadata": {"vulnerability": "CVE-2026-110642", "count": 22, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 15}}, "data": [{"timestamp": "2026-09-01T00:00:00Z", "date_only": false, "value": "2026-09-01T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110642", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:34.081Z", "date_only": false, "value": "2026-10-14T13:07:34.081Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110642", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:12.576Z", "date_only": false, "value": "2026-10-14T14:17:12.576Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110642", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:12.576Z", "date_only": false, "value": "2026-10-14T14:17:12.576Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110642", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:17Z", "date_only": false, "value": "2026-10-14T15:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P77Q-XQJ7-2552", "record": "GHSA-P77Q-XQJ7-2552", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:17.627Z", "date_only": false, "value": "2026-10-14T15:17:17.627", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110642", "record": "FKIE_CVE-2026-110642", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P77Q-XQJ7-2552", "record": "GHSA-P77Q-XQJ7-2552", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P77Q-XQJ7-2552", "record": "GHSA-P77Q-XQJ7-2552", "field": "modified"}, {"timestamp": "2026-10-14T18:17:59.438Z", "date_only": false, "value": "2026-10-14T18:17:59.438433Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110642", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T18:17:59.438Z", "date_only": false, "value": "2026-10-14T18:17:59.438433Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110642", "record": "FKIE_CVE-2026-110642", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T18:18:52.884Z", "date_only": false, "value": "2026-10-14T18:18:52.884Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110642", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:18:52.884Z", "date_only": false, "value": "2026-10-14T18:18:52.884Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110642", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:43:31.134Z", "date_only": false, "value": "2026-10-14T19:43:31.134448Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440971446951183", "record": "CVE-2026-110642", "field": "creation_timestamp", "uuid": "21bb3d54-459a-4000-b4b1-11601b2a4cc3", "content": "CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110642https://github.com/xhtml2pdf/xhtml2pdf/pull/835https://github.com/xhtml2pdf/xhtml2pdf/commit/f86380dad15b3a6810201d08755a3ee6b19d5063https://github.com/xhtml2pdf/xhtml2pdf/releases/tag/v0.2.19https://github.com/xhtml2pdf/xhtml2pdf/blob/v0.2.18/xhtml2pdf/pisa.py#L393-L400https://www.vulncheck.com/advisories/xhtml2pdf-before-0.2.19-os-command-injection-via-startviewer-file-name#xhtml2pdf#CVE_2026_110642#bot", "url": "https://infosec.exchange/users/cve/statuses/117440971446951183"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-110642", "record": "UBUNTU-CVE-2026-110642", "field": "published"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-110642", "record": "UBUNTU-CVE-2026-110642", "field": "modified"}, {"timestamp": "2026-10-15T14:47:05.720Z", "date_only": false, "value": "2026-10-15T14:47:05.720", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110642", "record": "FKIE_CVE-2026-110642", "field": "lastModified"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12160-1", "record": "OPENSUSE-SU-2026:12160-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12160-1", "record": "OPENSUSE-SU-2026:12160-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12160-1", "record": "OPENSUSE-SU-2026:12160-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12160-1", "record": "OPENSUSE-SU-2026:12160-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-17T09:17:56Z", "date_only": false, "value": "2026-10-17T09:17:56Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12160-1", "record": "OPENSUSE-SU-2026:12160-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-17T09:17:56Z", "date_only": false, "value": "2026-10-17T09:17:56Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12160-1", "record": "OPENSUSE-SU-2026:12160-1", "field": "document.tracking.current_release_date"}]}