{"metadata": {"vulnerability": "CVE-2026-110766", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110766", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T17:27:33.082Z", "date_only": false, "value": "2026-10-14T17:27:33.082Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110766", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T18:47:43.182Z", "date_only": false, "value": "2026-10-14T18:47:43.182Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110766", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:47:43.182Z", "date_only": false, "value": "2026-10-14T18:47:43.182Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110766", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:12Z", "date_only": false, "value": "2026-10-14T19:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WQ2V-XQ4C-MVCH", "record": "GHSA-WQ2V-XQ4C-MVCH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T19:17:12.460Z", "date_only": false, "value": "2026-10-14T19:17:12.460", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110766", "record": "FKIE_CVE-2026-110766", "field": "published"}, {"timestamp": "2026-10-14T19:38:39.974Z", "date_only": false, "value": "2026-10-14T19:38:39.974504Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110766", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T19:38:39.974Z", "date_only": false, "value": "2026-10-14T19:38:39.974504Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110766", "record": "FKIE_CVE-2026-110766", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T19:38:51.634Z", "date_only": false, "value": "2026-10-14T19:38:51.634Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110766", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:38:51.634Z", "date_only": false, "value": "2026-10-14T19:38:51.634Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110766", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T21:33:42Z", "date_only": false, "value": "2026-10-14T21:33:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WQ2V-XQ4C-MVCH", "record": "GHSA-WQ2V-XQ4C-MVCH", "field": "published"}, {"timestamp": "2026-10-14T21:33:42Z", "date_only": false, "value": "2026-10-14T21:33:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WQ2V-XQ4C-MVCH", "record": "GHSA-WQ2V-XQ4C-MVCH", "field": "modified"}, {"timestamp": "2026-10-14T23:55:19.464Z", "date_only": false, "value": "2026-10-14T23:55:19.464794Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441961524329621", "record": "CVE-2026-110766", "field": "creation_timestamp", "uuid": "ab9b80ea-1f18-432b-8dc1-99e8c280d0ac", "content": "CVE-2026-110766 Colanode Server through 0.4.7 Path Traversal via Avatar Download Route Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110766https://hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversalhttps://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/lib/storage/fs.ts#L38https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/api/client/routes/avatars/avatar-download.ts#L23https://github.com/colanode/colanodehttps://www.vulncheck.com/advisories/colanode-server-through-0.4.7-path-traversal-via-avatar-download-route#colanode#CVE_2026_110766#bot", "url": "https://infosec.exchange/users/cve/statuses/117441961524329621"}, {"timestamp": "2026-10-15T14:47:05.720Z", "date_only": false, "value": "2026-10-15T14:47:05.720", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110766", "record": "FKIE_CVE-2026-110766", "field": "lastModified"}]}