{"metadata": {"vulnerability": "CVE-2026-110643", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-08-05T00:00:00Z", "date_only": false, "value": "2026-08-05T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110643", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:34.426Z", "date_only": false, "value": "2026-10-14T13:07:34.426Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110643", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:13.152Z", "date_only": false, "value": "2026-10-14T14:17:13.152Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110643", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:13.152Z", "date_only": false, "value": "2026-10-14T14:17:13.152Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110643", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:17Z", "date_only": false, "value": "2026-10-14T15:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J3HR-HCVV-FG84", "record": "GHSA-J3HR-HCVV-FG84", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:17.790Z", "date_only": false, "value": "2026-10-14T15:17:17.790", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110643", "record": "FKIE_CVE-2026-110643", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J3HR-HCVV-FG84", "record": "GHSA-J3HR-HCVV-FG84", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J3HR-HCVV-FG84", "record": "GHSA-J3HR-HCVV-FG84", "field": "modified"}, {"timestamp": "2026-10-14T16:09:40.870Z", "date_only": false, "value": "2026-10-14T16:09:40.870559Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwocstiy2r", "record": "CVE-2026-110643", "field": "creation_timestamp", "uuid": "5d28db6e-e255-4ee3-a637-3da784104361", "content": "\ud83d\udea8 CVE-2026-110643 \u2014 CVSS 9.3 CRITICAL\n\ntranscribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to exec...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110643\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwocstiy2r"}, {"timestamp": "2026-10-14T16:50:05.019Z", "date_only": false, "value": "2026-10-14T16:50:05.019020Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtywkp2pu27", "record": "CVE-2026-110643", "field": "creation_timestamp", "uuid": "e5309989-e3d1-40dc-848d-f9e8daf26b5f", "content": "CVE-2026-110643 - transcribe2texts\nThe transcribe2texts program (versions up to 1.0.6) can be tricked into executing any command the attacker wants by giving it a specially crafted audioPath value.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#transcribe2texts #kkyykk #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtywkp2pu27"}, {"timestamp": "2026-10-14T19:44:11.536Z", "date_only": false, "value": "2026-10-14T19:44:11.536712Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440974093886810", "record": "CVE-2026-110643", "field": "creation_timestamp", "uuid": "148fff7d-3455-4fc2-a859-8963de078ef2", "content": "CVE-2026-110643 transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110643https://github.com/kky-ykk/Transcribe2texts/pull/1https://github.com/kky-ykk/Transcribe2texts/blob/7e82f96466fed9ccfc40f7b9e370321701b82c32/lib/index.js#L53-L55https://www.vulncheck.com/advisories/transcribe2texts-through-1.0.6-os-command-injection-via-transcribeaudio-audiopath#kky-ykk #transcribe2texts#CVE_2026_110643#bot", "url": "https://infosec.exchange/users/cve/statuses/117440974093886810"}, {"timestamp": "2026-10-16T16:48:51.569Z", "date_only": false, "value": "2026-10-16T16:48:51.569139Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110643", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:48:51.569Z", "date_only": false, "value": "2026-10-16T16:48:51.569139Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110643", "record": "FKIE_CVE-2026-110643", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T17:15:48.105Z", "date_only": false, "value": "2026-10-16T17:15:48.105Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110643", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:15:48.105Z", "date_only": false, "value": "2026-10-16T17:15:48.105Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110643", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:03:18.127Z", "date_only": false, "value": "2026-10-16T19:03:18.127", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110643", "record": "FKIE_CVE-2026-110643", "field": "lastModified"}]}