{"metadata": {"vulnerability": "CVE-2026-110909", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-15T02:56:38.476Z", "date_only": false, "value": "2026-10-15T02:56:38.476Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110909", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T02:56:38.852Z", "date_only": false, "value": "2026-10-15T02:56:38.852Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110909", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T02:56:38.852Z", "date_only": false, "value": "2026-10-15T02:56:38.852Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2026-110909", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T03:05:11.592Z", "date_only": false, "value": "2026-10-15T03:05:11.592365Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117442708156298683", "record": "CVE-2026-110909", "field": "creation_timestamp", "uuid": "239a75af-095d-4435-89d1-361a6c66f950", "content": "CVE-2026-110909  Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110909https://github.com/wheels-dev/wheels/security/advisories/GHSA-x3cm-2j3q-jgg4#Wheels #WheelsCLI#CVE_2026_110909#bot", "url": "https://infosec.exchange/users/cve/statuses/117442708156298683"}, {"timestamp": "2026-10-15T03:17:10Z", "date_only": false, "value": "2026-10-15T03:17:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8QGH-9996-H3C4", "record": "GHSA-8QGH-9996-H3C4", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T03:17:10.947Z", "date_only": false, "value": "2026-10-15T03:17:10.947", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110909", "record": "FKIE_CVE-2026-110909", "field": "published"}, {"timestamp": "2026-10-15T03:36:27Z", "date_only": false, "value": "2026-10-15T03:36:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8QGH-9996-H3C4", "record": "GHSA-8QGH-9996-H3C4", "field": "published"}, {"timestamp": "2026-10-15T03:36:27Z", "date_only": false, "value": "2026-10-15T03:36:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8QGH-9996-H3C4", "record": "GHSA-8QGH-9996-H3C4", "field": "modified"}, {"timestamp": "2026-10-15T04:08:16.751Z", "date_only": false, "value": "2026-10-15T04:08:16.751546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/auz7fmyjicud4", "record": "CVE-2026-110909", "field": "creation_timestamp", "uuid": "fb794643-eade-4c01-8b58-ab216931dc36", "content": "CVE-2026-110909 - Wheels CLI Improper Verification of Origin Vulnerability\nCVE ID : CVE-2026-110909\n \n Published : Oct. 15, 2026, 2:56 a.m. | 32\u00a0minutes ago\n \n Description : Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/auz7fmyjicud4"}, {"timestamp": "2026-10-20T02:36:17.391Z", "date_only": false, "value": "2026-10-20T02:36:17.391969Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110909", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T02:36:17.391Z", "date_only": false, "value": "2026-10-20T02:36:17.391969Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110909", "record": "FKIE_CVE-2026-110909", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T02:36:26.506Z", "date_only": false, "value": "2026-10-20T02:36:26.506Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110909", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T02:36:26.506Z", "date_only": false, "value": "2026-10-20T02:36:26.506Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110909", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T03:17:14.683Z", "date_only": false, "value": "2026-10-20T03:17:14.683", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110909", "record": "FKIE_CVE-2026-110909", "field": "lastModified"}]}