{"metadata": {"vulnerability": "CVE-2026-110646", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-06-29T00:00:00Z", "date_only": false, "value": "2026-06-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110646", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:35.409Z", "date_only": false, "value": "2026-10-14T13:07:35.409Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110646", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:15.120Z", "date_only": false, "value": "2026-10-14T14:17:15.120Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110646", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:15.120Z", "date_only": false, "value": "2026-10-14T14:17:15.120Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110646", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:18Z", "date_only": false, "value": "2026-10-14T15:17:18Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J7CW-XWMC-W7QG", "record": "GHSA-J7CW-XWMC-W7QG", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:18.237Z", "date_only": false, "value": "2026-10-14T15:17:18.237", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110646", "record": "FKIE_CVE-2026-110646", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J7CW-XWMC-W7QG", "record": "GHSA-J7CW-XWMC-W7QG", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J7CW-XWMC-W7QG", "record": "GHSA-J7CW-XWMC-W7QG", "field": "modified"}, {"timestamp": "2026-10-14T16:10:06.964Z", "date_only": false, "value": "2026-10-14T16:10:06.964359Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwp3j4rv2z", "record": "CVE-2026-110646", "field": "creation_timestamp", "uuid": "356e0dfb-20bd-459b-9249-936249e4265e", "content": "\ud83d\udea8 CVE-2026-110646 \u2014 CVSS 9.2 CRITICAL\n\nBeganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110646\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwp3j4rv2z"}, {"timestamp": "2026-10-14T17:00:07.309Z", "date_only": false, "value": "2026-10-14T17:00:07.309578Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtzij2co72z", "record": "CVE-2026-110646", "field": "creation_timestamp", "uuid": "443f0323-2ad1-4b0f-9e3f-a47606aa5202", "content": "CVE-2026-110646 - snappdf\nVersions 1.1.0 up to but not including 6.1.0 of the Snappdf library on Windows can be tricked into executing system commands when a crafted URL is supplied. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#snappdf #beganovich #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtzij2co72z"}, {"timestamp": "2026-10-14T19:46:12.509Z", "date_only": false, "value": "2026-10-14T19:46:12.509220Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440982028131793", "record": "CVE-2026-110646", "field": "creation_timestamp", "uuid": "83ca9cf0-f77a-47c9-a0ce-8c1a092bedd2", "content": "CVE-2026-110646 Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl() Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110646https://github.com/beganovich/snappdf/pull/54https://github.com/beganovich/snappdf/commit/5197bd3bcc4df44e17246dbceea9ce51eb390eaehttps://github.com/beganovich/snappdf/blob/v6.0.0/src/Snappdf.php#L280-L284https://github.com/beganovich/snappdf/releases/tag/v6.1.0https://www.vulncheck.com/advisories/beganovich-snappdf-1.1.0-before-6.1.0-os-command-injection-on-windows-via-seturl#beganovich #snappdf#CVE_2026_110646#bot", "url": "https://infosec.exchange/users/cve/statuses/117440982028131793"}, {"timestamp": "2026-10-20T01:24:33.049Z", "date_only": false, "value": "2026-10-20T01:24:33.049072Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110646", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T01:24:33.049Z", "date_only": false, "value": "2026-10-20T01:24:33.049072Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110646", "record": "FKIE_CVE-2026-110646", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T01:24:42.053Z", "date_only": false, "value": "2026-10-20T01:24:42.053Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110646", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T01:24:42.053Z", "date_only": false, "value": "2026-10-20T01:24:42.053Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110646", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T02:17:10.103Z", "date_only": false, "value": "2026-10-20T02:17:10.103", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110646", "record": "FKIE_CVE-2026-110646", "field": "lastModified"}]}