{"metadata": {"vulnerability": "CVE-2026-110645", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-06-21T00:00:00Z", "date_only": false, "value": "2026-06-21T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110645", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:35.099Z", "date_only": false, "value": "2026-10-14T13:07:35.099Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110645", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:14.471Z", "date_only": false, "value": "2026-10-14T14:17:14.471Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110645", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:14.471Z", "date_only": false, "value": "2026-10-14T14:17:14.471Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110645", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:18Z", "date_only": false, "value": "2026-10-14T15:17:18Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8MH7-3VXW-FRRX", "record": "GHSA-8MH7-3VXW-FRRX", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:18.090Z", "date_only": false, "value": "2026-10-14T15:17:18.090", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110645", "record": "FKIE_CVE-2026-110645", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8MH7-3VXW-FRRX", "record": "GHSA-8MH7-3VXW-FRRX", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8MH7-3VXW-FRRX", "record": "GHSA-8MH7-3VXW-FRRX", "field": "modified"}, {"timestamp": "2026-10-14T16:09:58.516Z", "date_only": false, "value": "2026-10-14T16:09:58.516656Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwothqth22", "record": "CVE-2026-110645", "field": "creation_timestamp", "uuid": "48f8bb0c-d503-4d25-9903-27aca318c1ff", "content": "\ud83d\udea8 CVE-2026-110645 \u2014 CVSS 9.3 CRITICAL\n\nVideo-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to ex...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110645\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwothqth22"}, {"timestamp": "2026-10-14T17:00:05.745Z", "date_only": false, "value": "2026-10-14T17:00:05.745275Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtzihjd3n2r", "record": "CVE-2026-110645", "field": "creation_timestamp", "uuid": "96d55a36-364f-4241-a698-191eb4f3bc9d", "content": "CVE-2026-110645 - video-stitch\nThe video\u2011stitch tool (versions before 2.0.0-beta.1) builds ffmpeg command lines using file names without proper checking. If a user can influence those file names,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#videostitch #arsalandotme #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtzihjd3n2r"}, {"timestamp": "2026-10-14T19:45:32.150Z", "date_only": false, "value": "2026-10-14T19:45:32.150852Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440979382259789", "record": "CVE-2026-110645", "field": "creation_timestamp", "uuid": "07d7fee6-e999-4ef6-b379-e49b94e17db0", "content": "CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut() Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110645https://github.com/ArsalanDotMe/VideoStitch/pull/26https://github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9bhttps://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99https://github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1https://www.vulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-injection-via-concat-and-cut#ArsalanDotMe #video-stitch#CVE_2026_110645#bot", "url": "https://infosec.exchange/users/cve/statuses/117440979382259789"}, {"timestamp": "2026-10-14T20:34:00.680Z", "date_only": false, "value": "2026-10-14T20:34:00.680625Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110645", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T20:34:00.680Z", "date_only": false, "value": "2026-10-14T20:34:00.680625Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110645", "record": "FKIE_CVE-2026-110645", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T20:34:06.275Z", "date_only": false, "value": "2026-10-14T20:34:06.275Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110645", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T20:34:06.275Z", "date_only": false, "value": "2026-10-14T20:34:06.275Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110645", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T14:47:05.720Z", "date_only": false, "value": "2026-10-15T14:47:05.720", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110645", "record": "FKIE_CVE-2026-110645", "field": "lastModified"}]}