{"metadata": {"vulnerability": "CVE-2026-110649", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-08-05T00:00:00Z", "date_only": false, "value": "2026-08-05T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110649", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:36.337Z", "date_only": false, "value": "2026-10-14T13:07:36.337Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110649", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:16.991Z", "date_only": false, "value": "2026-10-14T14:17:16.991Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110649", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:16.991Z", "date_only": false, "value": "2026-10-14T14:17:16.991Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110649", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:18Z", "date_only": false, "value": "2026-10-14T15:17:18Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-53P6-95M7-9C4H", "record": "GHSA-53P6-95M7-9C4H", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:18.650Z", "date_only": false, "value": "2026-10-14T15:17:18.650", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110649", "record": "FKIE_CVE-2026-110649", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-53P6-95M7-9C4H", "record": "GHSA-53P6-95M7-9C4H", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-53P6-95M7-9C4H", "record": "GHSA-53P6-95M7-9C4H", "field": "modified"}, {"timestamp": "2026-10-14T16:10:15.565Z", "date_only": false, "value": "2026-10-14T16:10:15.565326Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwpdy7t22l", "record": "CVE-2026-110649", "field": "creation_timestamp", "uuid": "1f431152-cb41-4753-b9b6-c6a794fa9298", "content": "\ud83d\udea8 CVE-2026-110649 \u2014 CVSS 9.3 CRITICAL\n\nStills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110649\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwpdy7t22l"}, {"timestamp": "2026-10-14T17:10:05.084Z", "date_only": false, "value": "2026-10-14T17:10:05.084078Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxu22d5sw22l", "record": "CVE-2026-110649", "field": "creation_timestamp", "uuid": "d4c9c6da-1a95-4a32-b94a-b33ffaa771b5", "content": "CVE-2026-110649 - stills\nThe Stills image processing tool versions earlier than 25.24.2 can be tricked into running operating system commands when a specially crafted media file name is used. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#stills #shahkashani #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxu22d5sw22l"}, {"timestamp": "2026-10-14T17:36:24.379Z", "date_only": false, "value": "2026-10-14T17:36:24.379780Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110649", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T17:36:24.379Z", "date_only": false, "value": "2026-10-14T17:36:24.379780Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110649", "record": "FKIE_CVE-2026-110649", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T17:36:45.292Z", "date_only": false, "value": "2026-10-14T17:36:45.292Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110649", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T17:36:45.292Z", "date_only": false, "value": "2026-10-14T17:36:45.292Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110649", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:48:13.757Z", "date_only": false, "value": "2026-10-14T19:48:13.757274Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440989961005171", "record": "CVE-2026-110649", "field": "creation_timestamp", "uuid": "d09d2145-b236-4e56-8ada-d76f65dba5ec", "content": "CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110649https://github.com/shahkashani/stills/pull/29https://github.com/shahkashani/stills/pull/30https://github.com/shahkashani/stills/commit/5694b3b0dcd2da342f4f0497244129d4c9eb73bchttps://github.com/shahkashani/stills/commit/51ba953983ba99915331607bf8530e6089952253https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/stills/frames.js#L106-L108https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/content/video.js#L58-L60https://www.vulncheck.com/advisories/stills-before-25.24.2-os-command-injection-via-media-file-names#shahkashani #stills#CVE_2026_110649#bot", "url": "https://infosec.exchange/users/cve/statuses/117440989961005171"}, {"timestamp": "2026-10-16T19:18:44.867Z", "date_only": false, "value": "2026-10-16T19:18:44.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110649", "record": "FKIE_CVE-2026-110649", "field": "lastModified"}]}