{"metadata": {"vulnerability": "CVE-2026-119050", "count": 14, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-07-02T00:00:00Z", "date_only": false, "value": "2026-07-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119050", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T11:51:50.876Z", "date_only": false, "value": "2026-10-29T11:51:50.876Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119050", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T13:08:51.517Z", "date_only": false, "value": "2026-10-29T13:08:51.517Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119050", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T13:08:51.517Z", "date_only": false, "value": "2026-10-29T13:08:51.517Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119050", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-29T13:08:51.517Z", "date_only": false, "value": "2026-10-29T13:08:51.517Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119050", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T13:26:32.307Z", "date_only": false, "value": "2026-10-29T13:26:32.307838Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117524423751710255", "record": "CVE-2026-119050", "field": "creation_timestamp", "uuid": "d8607b3a-ffea-4327-b8b4-e44721858138", "content": "CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119050https://github.com/agno-agi/agno/issues/8699https://github.com/agno-agi/agnohttps://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L54https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L90https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection#agno-agi #agno#CVE_2026_119050#bot", "url": "https://infosec.exchange/users/cve/statuses/117524423751710255"}, {"timestamp": "2026-10-29T14:17:51Z", "date_only": false, "value": "2026-10-29T14:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JQ64-VHH4-4HVV", "record": "GHSA-JQ64-VHH4-4HVV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-29T14:17:51.990Z", "date_only": false, "value": "2026-10-29T14:17:51.990", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119050", "record": "FKIE_CVE-2026-119050", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T14:17:52.113Z", "date_only": false, "value": "2026-10-29T14:17:52.113", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119050", "record": "FKIE_CVE-2026-119050", "field": "lastModified"}, {"timestamp": "2026-10-29T14:29:09.372Z", "date_only": false, "value": "2026-10-29T14:29:09.372536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/2vg5umq3wimog", "record": "CVE-2026-119050", "field": "creation_timestamp", "uuid": "913b49ec-c5ce-48f7-85da-debe52fb7d08", "content": "CVE-2026-119050\nNew critical vulnerability: CVSS 9.2.\nhttps://cvesentinel.com/report/CVE-2026-119050", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/2vg5umq3wimog"}, {"timestamp": "2026-10-29T14:40:05.007Z", "date_only": false, "value": "2026-10-29T14:40:05.007475Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myzinvpvwz2p", "record": "CVE-2026-119050", "field": "creation_timestamp", "uuid": "6e72106e-2659-4fcc-a7ae-712bca05852a", "content": "CVE-2026-119050 - agno\nThe Agno software (versions up to 3.1.11) can be tricked into executing any Python code by letting a user specify a function name that the system then calls. An attacker could cause the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#agno #agnoagi #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myzinvpvwz2p"}, {"timestamp": "2026-10-29T15:30:53Z", "date_only": false, "value": "2026-10-29T15:30:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JQ64-VHH4-4HVV", "record": "GHSA-JQ64-VHH4-4HVV", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T15:30:53Z", "date_only": false, "value": "2026-10-29T15:30:53Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JQ64-VHH4-4HVV", "record": "GHSA-JQ64-VHH4-4HVV", "field": "modified"}, {"timestamp": "2026-10-29T16:07:15.106Z", "date_only": false, "value": "2026-10-29T16:07:15.106610Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3myznjrpyjs2w", "record": "CVE-2026-119050", "field": "creation_timestamp", "uuid": "5d12759f-702e-4279-9b9d-279bef126499", "content": "\ud83d\udea8 CVE-2026-119050 \u2014 CVSS 9.2 CRITICAL\n\nAgno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to inv...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-119050\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3myznjrpyjs2w"}], "metrics": {"as_of": "2026-11-01T00:14:18.085Z", "anchors": {"origin": {"timestamp": "2026-07-02T00:00:00Z", "date_only": false, "value": "2026-07-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119050", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-02T00:00:00Z", "date_only": false, "value": "2026-07-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119050", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 10541658.085027, "hours": 2928.2383569519443, "days": 122.00993153966435, "min_seconds": 10455258.085027, "max_seconds": 10541658.085027, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-02T00:00:00Z", "date_only": false, "value": "2026-07-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119050", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T00:14:18.085Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}