{"metadata": {"vulnerability": "CVE-2026-16477", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-07-21T12:00:00Z", "date_only": false, "value": "2026-07-21T12:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-16477", "field": "containers.cna.datePublic"}, {"timestamp": "2026-07-21T14:22:56.242Z", "date_only": false, "value": "2026-07-21T14:22:56.242Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-16477", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-22T06:55:00Z", "date_only": false, "value": "2026-10-22T06:55:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cert.pl/en/posts/2026/10/CVE-2026-16477", "record": "CVE-2026-16477", "field": "creation_timestamp", "uuid": "59d5384d-3271-4548-83c8-f323ec9986bc", "url": "https://cert.pl/en/posts/2026/10/CVE-2026-16477"}, {"timestamp": "2026-10-22T14:47:26.652Z", "date_only": false, "value": "2026-10-22T14:47:26.652Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16477", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-22T14:47:26.652Z", "date_only": false, "value": "2026-10-22T14:47:26.652Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CERT-PL", "record": "CVE-2026-16477", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-22T14:56:50.506Z", "date_only": false, "value": "2026-10-22T14:56:50.506053Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117485142665797300", "record": "CVE-2026-16477", "field": "creation_timestamp", "uuid": "3fe71263-151f-4d5e-a94e-f74d10df00ce", "content": "CVE-2026-16477 Insecure Deserialization of .cleanshot Files in CleanShot X CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10\nhttps://www.cve.org/CVERecord?id=CVE-2026-16477https://cert.pl/en/posts/2026/10/CVE-2026-16477https://cleanshot.com/#cleanshot #MTW #CleanShotX#CVE_2026_16477#bot", "url": "https://infosec.exchange/users/cve/statuses/117485142665797300"}, {"timestamp": "2026-10-22T15:17:05Z", "date_only": false, "value": "2026-10-22T15:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9GJ2-4MHG-73V2", "record": "GHSA-9GJ2-4MHG-73V2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-22T15:17:05.817Z", "date_only": false, "value": "2026-10-22T15:17:05.817", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16477", "record": "FKIE_CVE-2026-16477", "field": "published"}, {"timestamp": "2026-10-22T15:23:03.708Z", "date_only": false, "value": "2026-10-22T15:23:03.708342Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16477", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-22T15:23:03.708Z", "date_only": false, "value": "2026-10-22T15:23:03.708342Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16477", "record": "FKIE_CVE-2026-16477", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-22T15:32:50Z", "date_only": false, "value": "2026-10-22T15:32:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9GJ2-4MHG-73V2", "record": "GHSA-9GJ2-4MHG-73V2", "field": "published"}, {"timestamp": "2026-10-22T15:32:50Z", "date_only": false, "value": "2026-10-22T15:32:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9GJ2-4MHG-73V2", "record": "GHSA-9GJ2-4MHG-73V2", "field": "modified"}, {"timestamp": "2026-10-22T19:00:31.571Z", "date_only": false, "value": "2026-10-22T19:00:31.571Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-16477", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-22T19:00:31.571Z", "date_only": false, "value": "2026-10-22T19:00:31.571Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16477", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-22T19:17:50.770Z", "date_only": false, "value": "2026-10-22T19:17:50.770", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16477", "record": "FKIE_CVE-2026-16477", "field": "lastModified"}]}