{"metadata": {"vulnerability": "CVE-2026-24747", "count": 119, "kinds": {"milestone": 12, "sighting": 3, "kev": 0, "other": 104}, "linked_omitted": 0}, "data": [{"timestamp": "2025-06-12T17:02:11.238Z", "date_only": false, "value": "2025-06-12T17:02:11.238000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.1.discovery_date", "linked_record": true}, {"timestamp": "2025-08-26T14:51:41.716Z", "date_only": false, "value": "2025-08-26T14:51:41.716000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.1.release_date", "linked_record": true}, {"timestamp": "2026-01-05T23:19:31.396Z", "date_only": false, "value": "2026-01-05T23:19:31.396000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.4.release_date", "linked_record": true}, {"timestamp": "2026-01-05T23:30:33.440Z", "date_only": false, "value": "2026-01-05T23:30:33.440000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.5.release_date", "linked_record": true}, {"timestamp": "2026-01-06T00:01:02.119Z", "date_only": false, "value": "2026-01-06T00:01:02.119065+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.5.discovery_date", "linked_record": true}, {"timestamp": "2026-01-06T00:01:17.036Z", "date_only": false, "value": "2026-01-06T00:01:17.036900+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.4.discovery_date", "linked_record": true}, {"timestamp": "2026-01-16T19:03:36.442Z", "date_only": false, "value": "2026-01-16T19:03:36.442000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.9.release_date", "linked_record": true}, {"timestamp": "2026-01-16T20:03:33.790Z", "date_only": false, "value": "2026-01-16T20:03:33.790513+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.9.discovery_date", "linked_record": true}, {"timestamp": "2026-01-26T19:06:16.059Z", "date_only": false, "value": "2026-01-26T19:06:16.059Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-24747", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-01-26T23:00:00Z", "date_only": false, "value": "2026-01-26T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-01-26T23:00:00Z", "date_only": false, "value": "2026-01-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-26T23:00:00Z", "date_only": false, "value": "2026-01-26T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-27T20:10:54Z", "date_only": false, "value": "2026-01-27T20:10:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-63CW-57P8-FM3P", "record": "GHSA-63CW-57P8-FM3P", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-27T21:13:46.878Z", "date_only": false, "value": "2026-01-27T21:13:46.878Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-24747", "field": "containers.adp.1.datePublic"}, {"timestamp": "2026-01-27T21:13:46.878Z", "date_only": false, "value": "2026-01-27T21:13:46.878Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-24747", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-01-27T21:13:46.878Z", "date_only": false, "value": "2026-01-27T21:13:46.878000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-27T21:13:46.878Z", "date_only": false, "value": "2026-01-27T21:13:46.878Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-24747", "field": "containers.adp.1.timeline.1.time", "text": "Made public."}, {"timestamp": "2026-01-27T21:13:46.878Z", "date_only": false, "value": "2026-01-27T21:13:46.878Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-24747", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-01-27T22:01:52.649Z", "date_only": false, "value": "2026-01-27T22:01:52.649884+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-27T22:01:52.649Z", "date_only": false, "value": "2026-01-27T22:01:52.649Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-24747", "field": "containers.adp.1.timeline.0.time", "text": "Reported to Red Hat."}, {"timestamp": "2026-01-27T22:15:00Z", "date_only": false, "value": "2026-01-27T22:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-24747", "record": "UBUNTU-CVE-2026-24747", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-27T22:15:56Z", "date_only": false, "value": "2026-01-27T22:15:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-63CW-57P8-FM3P", "record": "GHSA-63CW-57P8-FM3P", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-01-27T22:15:56.470Z", "date_only": false, "value": "2026-01-27T22:15:56.470", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-24747", "record": "FKIE_CVE-2026-24747", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-27T22:15:56.470Z", "date_only": false, "value": "2026-01-27T22:15:56.470Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-2286", "record": "PYSEC-2026-2286", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-27T23:00:00Z", "date_only": false, "value": "2026-01-27T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-01-27T23:02:06.363Z", "date_only": false, "value": "2026-01-27T23:02:06.363821Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mdguifixce25", "record": "CVE-2026-24747", "field": "creation_timestamp", "uuid": "d6cff9e2-d3df-48c1-a9b0-ed041918d5be", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mdguifixce25"}, {"timestamp": "2026-01-27T23:02:34.762Z", "date_only": false, "value": "2026-01-27T23:02:34.762894Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mdgujasel22x", "record": "CVE-2026-24747", "field": "creation_timestamp", "uuid": "16b685aa-1a5a-4290-a2e3-672728724ba9", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mdgujasel22x"}, {"timestamp": "2026-01-28T19:30:31.215Z", "date_only": false, "value": "2026-01-28T19:30:31.215000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.2.release_date", "linked_record": true}, {"timestamp": "2026-01-28T20:01:42.791Z", "date_only": false, "value": "2026-01-28T20:01:42.791305+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.2.discovery_date", "linked_record": true}, {"timestamp": "2026-01-29T08:50:25.994Z", "date_only": false, "value": "2026-01-29T08:50:25.994Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-PYTORCH-2026-24747", "record": "BIT-PYTORCH-2026-24747", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-01-30T04:55:40.763Z", "date_only": false, "value": "2026-01-30T04:55:40.763016Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-24747", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-01-30T04:55:40.763Z", "date_only": false, "value": "2026-01-30T04:55:40.763016Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-24747", "record": "FKIE_CVE-2026-24747", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-02-26T15:04:50.008Z", "date_only": false, "value": "2026-02-26T15:04:50.008Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-24747", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-03-05T15:34:42.095Z", "date_only": false, "value": "2026-03-05T15:34:42.095000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.11.release_date", "linked_record": true}, {"timestamp": "2026-03-05T16:01:14.634Z", "date_only": false, "value": "2026-03-05T16:01:14.634884+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.11.discovery_date", "linked_record": true}, {"timestamp": "2026-03-06T00:00:00Z", "date_only": false, "value": "2026-03-06T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.18.discovery_date", "linked_record": true}, {"timestamp": "2026-03-06T07:23:05.716Z", "date_only": false, "value": "2026-03-06T07:23:05.716000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.18.release_date", "linked_record": true}, {"timestamp": "2026-03-06T18:25:22.438Z", "date_only": false, "value": "2026-03-06T18:25:22.438000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.17.release_date", "linked_record": true}, {"timestamp": "2026-03-06T19:00:57.982Z", "date_only": false, "value": "2026-03-06T19:00:57.982727+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.17.discovery_date", "linked_record": true}, {"timestamp": "2026-03-09T21:01:01.827Z", "date_only": false, "value": "2026-03-09T21:01:01.827000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.12.release_date", "linked_record": true}, {"timestamp": "2026-03-09T22:02:05.461Z", "date_only": false, "value": "2026-03-09T22:02:05.461167+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.12.discovery_date", "linked_record": true}, {"timestamp": "2026-03-11T19:27:23.380Z", "date_only": false, "value": "2026-03-11T19:27:23.380000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.19.release_date", "linked_record": true}, {"timestamp": "2026-03-11T20:02:00.687Z", "date_only": false, "value": "2026-03-11T20:02:00.687153+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.19.discovery_date", "linked_record": true}, {"timestamp": "2026-03-12T21:41:50.427Z", "date_only": false, "value": "2026-03-12T21:41:50.427000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.21.release_date", "linked_record": true}, {"timestamp": "2026-03-12T22:01:29.967Z", "date_only": false, "value": "2026-03-12T22:01:29.967713+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.21.discovery_date", "linked_record": true}, {"timestamp": "2026-03-17T19:33:50.107Z", "date_only": false, "value": "2026-03-17T19:33:50.107000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.22.release_date", "linked_record": true}, {"timestamp": "2026-03-17T20:01:37.453Z", "date_only": false, "value": "2026-03-17T20:01:37.453284+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.22.discovery_date", "linked_record": true}, {"timestamp": "2026-03-18T01:15:07.644Z", "date_only": false, "value": "2026-03-18T01:15:07.644000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.15.release_date", "linked_record": true}, {"timestamp": "2026-03-18T02:01:35.207Z", "date_only": false, "value": "2026-03-18T02:01:35.207658+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.15.discovery_date", "linked_record": true}, {"timestamp": "2026-03-20T22:23:32.147Z", "date_only": false, "value": "2026-03-20T22:23:32.147000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.23.release_date", "linked_record": true}, {"timestamp": "2026-03-20T22:45:40.784Z", "date_only": false, "value": "2026-03-20T22:45:40.784000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.24.release_date", "linked_record": true}, {"timestamp": "2026-03-20T23:02:27.802Z", "date_only": false, "value": "2026-03-20T23:02:27.802640+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.23.discovery_date", "linked_record": true}, {"timestamp": "2026-03-20T23:02:37.298Z", "date_only": false, "value": "2026-03-20T23:02:37.298405+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.24.discovery_date", "linked_record": true}, {"timestamp": "2026-03-26T23:56:53.579Z", "date_only": false, "value": "2026-03-26T23:56:53.579000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.14.release_date", "linked_record": true}, {"timestamp": "2026-03-27T00:01:43.935Z", "date_only": false, "value": "2026-03-27T00:01:43.935417+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.14.discovery_date", "linked_record": true}, {"timestamp": "2026-03-31T19:25:55.987Z", "date_only": false, "value": "2026-03-31T19:25:55.987000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.7.release_date", "linked_record": true}, {"timestamp": "2026-03-31T20:01:21.918Z", "date_only": false, "value": "2026-03-31T20:01:21.918257+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.7.discovery_date", "linked_record": true}, {"timestamp": "2026-04-01T17:33:51.281Z", "date_only": false, "value": "2026-04-01T17:33:51.281000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.13.release_date", "linked_record": true}, {"timestamp": "2026-04-01T18:01:42.208Z", "date_only": false, "value": "2026-04-01T18:01:42.208947+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.13.discovery_date", "linked_record": true}, {"timestamp": "2026-04-06T16:22:45.353Z", "date_only": false, "value": "2026-04-06T16:22:45.353000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.25.release_date", "linked_record": true}, {"timestamp": "2026-04-06T17:01:34.639Z", "date_only": false, "value": "2026-04-06T17:01:34.639203+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.25.discovery_date", "linked_record": true}, {"timestamp": "2026-04-08T01:06:58.595Z", "date_only": false, "value": "2026-04-08T01:06:58.595000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.20.release_date", "linked_record": true}, {"timestamp": "2026-04-08T02:01:19.572Z", "date_only": false, "value": "2026-04-08T02:01:19.572351+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.20.discovery_date", "linked_record": true}, {"timestamp": "2026-04-08T20:49:41.967Z", "date_only": false, "value": "2026-04-08T20:49:41.967000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.27.release_date", "linked_record": true}, {"timestamp": "2026-04-08T22:00:59.416Z", "date_only": false, "value": "2026-04-08T22:00:59.416053+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.27.discovery_date", "linked_record": true}, {"timestamp": "2026-04-09T14:31:46.067Z", "date_only": false, "value": "2026-04-09T14:31:46.067000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.3.release_date", "linked_record": true}, {"timestamp": "2026-04-09T15:01:48.111Z", "date_only": false, "value": "2026-04-09T15:01:48.111177+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.3.discovery_date", "linked_record": true}, {"timestamp": "2026-04-13T14:55:28.649Z", "date_only": false, "value": "2026-04-13T14:55:28.649000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.6.release_date", "linked_record": true}, {"timestamp": "2026-04-13T15:02:12.634Z", "date_only": false, "value": "2026-04-13T15:02:12.634661+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.6.discovery_date", "linked_record": true}, {"timestamp": "2026-04-15T08:56:34.057Z", "date_only": false, "value": "2026-04-15T08:56:34.057000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-04-15T10:01:27.769Z", "date_only": false, "value": "2026-04-15T10:01:27.769752+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-04-15T22:53:56.147Z", "date_only": false, "value": "2026-04-15T22:53:56.147000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.28.release_date", "linked_record": true}, {"timestamp": "2026-04-16T00:00:49.590Z", "date_only": false, "value": "2026-04-16T00:00:49.590876+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.28.discovery_date", "linked_record": true}, {"timestamp": "2026-04-18T16:18:10.652Z", "date_only": false, "value": "2026-04-18T16:18:10.652000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.31.release_date", "linked_record": true}, {"timestamp": "2026-04-18T17:00:50.677Z", "date_only": false, "value": "2026-04-18T17:00:50.677423+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.31.discovery_date", "linked_record": true}, {"timestamp": "2026-04-20T16:25:12.302Z", "date_only": false, "value": "2026-04-20T16:25:12.302000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.16.release_date", "linked_record": true}, {"timestamp": "2026-04-20T17:02:18.205Z", "date_only": false, "value": "2026-04-20T17:02:18.205732+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.16.discovery_date", "linked_record": true}, {"timestamp": "2026-04-21T19:59:59.759Z", "date_only": false, "value": "2026-04-21T19:59:59.759000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.29.release_date", "linked_record": true}, {"timestamp": "2026-04-21T21:02:33.280Z", "date_only": false, "value": "2026-04-21T21:02:33.280553+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.29.discovery_date", "linked_record": true}, {"timestamp": "2026-04-23T14:54:32.426Z", "date_only": false, "value": "2026-04-23T14:54:32.426000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.30.release_date", "linked_record": true}, {"timestamp": "2026-04-23T16:04:41.751Z", "date_only": false, "value": "2026-04-23T16:04:41.751666+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.30.discovery_date", "linked_record": true}, {"timestamp": "2026-04-24T17:36:44.132Z", "date_only": false, "value": "2026-04-24T17:36:44.132000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.32.release_date", "linked_record": true}, {"timestamp": "2026-04-24T17:38:07.752Z", "date_only": false, "value": "2026-04-24T17:38:07.752000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.33.release_date", "linked_record": true}, {"timestamp": "2026-04-24T17:54:42.668Z", "date_only": false, "value": "2026-04-24T17:54:42.668000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.36.release_date", "linked_record": true}, {"timestamp": "2026-04-24T17:55:30.036Z", "date_only": false, "value": "2026-04-24T17:55:30.036000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.35.release_date", "linked_record": true}, {"timestamp": "2026-04-24T18:01:17.109Z", "date_only": false, "value": "2026-04-24T18:01:17.109481+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.33.discovery_date", "linked_record": true}, {"timestamp": "2026-04-24T18:01:20.937Z", "date_only": false, "value": "2026-04-24T18:01:20.937507+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.32.discovery_date", "linked_record": true}, {"timestamp": "2026-04-24T18:01:30.775Z", "date_only": false, "value": "2026-04-24T18:01:30.775000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.34.release_date", "linked_record": true}, {"timestamp": "2026-04-24T19:01:22.552Z", "date_only": false, "value": "2026-04-24T19:01:22.552379+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.36.discovery_date", "linked_record": true}, {"timestamp": "2026-04-24T19:01:41.034Z", "date_only": false, "value": "2026-04-24T19:01:41.034289+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.35.discovery_date", "linked_record": true}, {"timestamp": "2026-04-24T19:01:44.887Z", "date_only": false, "value": "2026-04-24T19:01:44.887156+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.34.discovery_date", "linked_record": true}, {"timestamp": "2026-05-04T19:31:57.253Z", "date_only": false, "value": "2026-05-04T19:31:57.253000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.8.release_date", "linked_record": true}, {"timestamp": "2026-05-04T20:01:14.938Z", "date_only": false, "value": "2026-05-04T20:01:14.938426+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.8.discovery_date", "linked_record": true}, {"timestamp": "2026-06-02T18:29:15.847Z", "date_only": false, "value": "2026-06-02T18:29:15.847000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.26.release_date", "linked_record": true}, {"timestamp": "2026-06-02T20:01:12.690Z", "date_only": false, "value": "2026-06-02T20:01:12.690409+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.26.discovery_date", "linked_record": true}, {"timestamp": "2026-06-09T22:00:00Z", "date_only": false, "value": "2026-06-09T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-06-09T22:00:00Z", "date_only": false, "value": "2026-06-09T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-06-10T04:27:13Z", "date_only": false, "value": "2026-06-10T04:27:13+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-06-10T04:27:13Z", "date_only": false, "value": "2026-06-10T04:27:13+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-10T04:27:13Z", "date_only": false, "value": "2026-06-10T04:27:13+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-10T07:45:55.183Z", "date_only": false, "value": "2026-06-10T07:45:55.183+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-07-07T16:03:20.837Z", "date_only": false, "value": "2026-07-07T16:03:20.837738Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-1856", "record": "PYSEC-2026-1856", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-07T17:25:15.153Z", "date_only": false, "value": "2026-07-07T17:25:15.153263Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-1856", "record": "PYSEC-2026-1856", "field": "modified", "linked_record": true}, {"timestamp": "2026-07-13T05:52:12.933Z", "date_only": false, "value": "2026-07-13T05:52:12.933057Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-2286", "record": "PYSEC-2026-2286", "field": "modified", "linked_record": true}, {"timestamp": "2026-07-15T01:17:00.817Z", "date_only": false, "value": "2026-07-15T01:17:00.817Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-24747", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-15T01:17:00.817Z", "date_only": false, "value": "2026-07-15T01:17:00.817Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-24747", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-15T02:18:50.693Z", "date_only": false, "value": "2026-07-15T02:18:50.693", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-24747", "record": "FKIE_CVE-2026-24747", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-08-24T15:42:13.465Z", "date_only": false, "value": "2026-08-24T15:42:13.465292Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/rahulXs/33981c9d91701115bb44ac406396c782", "record": "CVE-2026-24747", "field": "creation_timestamp", "uuid": "64b7ddf1-503c-48d9-acb6-5a308664fc17", "content": "# The AI Odyssey: When Your Model Is the Trojan Horse\n\n### All resources from my talk at **OOSC 4.0 | IIIT Allahabad | Aug 28\u201330, 2026**\n\n**Rahul Sharma** | Senior Software Engineer, Red Hat | [@rahulXs](https://github.com/rahulXs)\n\n---\n\n## Contents\n\n1. [Quick Start - Sign Your First Model](#-quick-start--sign-your-first-model)\n2. [Demo Code (in this gist)](#-demo-code-in-this-gist)\n3. [Safety Checklist](#-safety-checklist)\n4. [Open Source Projects (contribute!)](#-open-source-projects-contribute)\n5. [CVEs & Security Advisories](#-cves--security-advisories)\n6. [Research Papers](#-research-papers)\n7. [Articles & Deep Dives](#-articles--deep-dives)\n8. [Incident Timeline](#-incident-timeline)\n9. [About Me](#-about-me)\n\n---\n\n## Quick Start - Sign Your First Model\n\nThree commands. No key management. No GPG. No certificate rotation.\n\n```bash\npip install model-signing\n\nmodel_signing sign ./my-model/\n\nmodel_signing verify ./my-model/ \\\n  --signature model.sig \\\n  --identity \"your-email@example.com\" \\\n  --identity_provider \"https://accounts.google.com\"\n```\n\n- Signing authenticates via OIDC in your browser (Google/GitHub login).\n- The signature is a detached Sigstore bundle (`model.sig`) wrapping an in-toto attestation of SHA-256 hashes.\n- Verification works offline once you have the bundle.\n\n---\n\n## Demo Code (in this gist)\n\nThe exact files from Demo 1; everything runs on **localhost only**, nothing leaves your machine:\n\n| File | What it does |\n|---|---|\n| [`create_demo_model.py`](./create_demo_model.py) | Creates a small legitimate PyTorch model (the contrast) |\n| [`create_malicious_model.py`](./create_malicious_model.py) | Creates a `.pt` file with a reverse shell in `__reduce__` (**DEMO ONLY**, connects to `127.0.0.1:9999`) |\n| [`load_model.py`](./load_model.py) | Loads the model with `weights_only=False` - what legacy tutorials still teach |\n\nRun it yourself (in a VM/container if you want to be extra safe):\n\n```bash\nmkdir -p models && cd oosc-demo\npython create_demo_model.py\npython create_malicious_model.py\n\n# Terminal A (attacker):   nc -l 9999\n# Terminal B (victim):     python load_model.py\n```\n\n> **How it works:** `torch.save()` uses pickle internally. During `torch.load()`, pickle calls `__reduce__()` to reconstruct objects, whatever it returns gets executed. Here that's `os.system(reverse_shell)`, backgrounded so the load \"succeeds\" silently. Not a bug - documented Python behavior. Python docs literally say *\"Never unpickle data from an untrusted source.\"*\n\n---\n\n## Safety Checklist\n\n**Do:**\n\n- Use **SafeTensors** for all new models \u2014 no pickle, no code execution on load\n- Use `torch.load(..., weights_only=True)` at minimum (default since PyTorch 2.6)\n- **Sign** models before sharing (`pip install model-signing`)\n- **Verify** signatures before loading any model\n- Pin models by **commit hash**, not branch name\n\n**Don't:**\n\n- Never disable safety flags (`weights_only=False`) on untrusted files\n- Never set `trust_remote_code=True` without reading the code first\n- Never load pickle models outside a sandbox/VM if you can avoid it\n- Never assume a scanner passing = file is safe (see ShadowPickle below)\n\n---\n\n## Open Source Projects (contribute!)\n\nAll are beginner-friendly and accepting contributions:\n\n| Project | Link | Why it matters |\n|---|---|---|\n| **Model Signing (OMS)** | https://github.com/sigstore/model-transparency | Sign/verify model artifacts. Implements the OpenSSF Model Signing spec. `pip install model-signing` |\n| **OMS Specification** | https://github.com/ossf/model-signing-spec | The formal spec (June 2025), backed by Google, NVIDIA, HiddenLayer, Red Hat |\n| **SafeTensors** | https://github.com/huggingface/safetensors | Safe serialization format tensors + JSON only, zero-copy. Joined PyTorch Foundation, Mar 2026 |\n| **Fickling** | https://github.com/trailofbits/fickling | Pickle decompiler & safety analyzer by Trail of Bits. Inspect suspicious pickles without executing them |\n| **Sigstore** | https://www.sigstore.dev/ | Keyless signing infra (\"Let's Encrypt for code signing\") Fulcio CA + Rekor transparency log |\n\n---\n\n## CVEs & Security Advisories\n\n| ID | What happened | Reference |\n|---|---|---|\n| **CVE-2026-24747** | `weights_only=True` bypassed via heap corruption (type confusion in C++ restricted unpickler, `SETITEM` opcode). CVSS 8.8. Fixed in PyTorch 2.10.0 | [GHSA-63CW-57P8-FM3P](https://github.com/advisories/GHSA-63CW-57P8-FM3P) \u00b7 [RAXE-2026-019](https://raxe.ai/labs/advisories/RAXE-2026-019) |\n| **CVE-2026-3490** | PickleScan blocklist universally bypassed via `pkgutil.resolve_name(\"os:system\")` indirection; 11+ RCE chains all reported CLEAN | [GHSA-VVPJ-8CMC-GX39](https://github.com/advisories/ghsa-vvpj-8cmc-gx39) \u00b7 [RAXE-2026-015](https://raxe.ai/labs/advisories/RAXE-2026-015) |\n| **CVE-2025-1716, -1889, -1944, -1945** | Four PickleScan zero-days | See timeline below |\n\n**Key takeaway:** both the framework defense *and* the principal scanner were broken in 2026. You cannot blocklist your way out of a Turing-complete format. Defense = safer format + cryptographic verification.\n\n---\n\n## Research Papers\n\n- **ShadowPickle: Evading ML Model Scanners via Stealthy Pickle Attacks** *(arXiv, Jul 2026)* three novel attacks exploiting pickle's module import mechanism; best variant evades **63% of scanners** including Hugging Face's. Introduces PickleBench.\n  https://arxiv.org/html/2607.17503\n- **Exploiting Python pickling** David Hamann's classic walkthrough of `__reduce__` RCE (the technique behind our Demo 1).\n  https://davidhamann.de/2020/04/05/exploiting-python-pickle/\n- **DEF CON 33: Loading Models, Launching Shells** Cyrus Parzian, 2025.\n  https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/\n\n## Articles & Deep Dives\n\n**Model signing / Sigstore:**\n- An Introduction to the OpenSSF Model Signing (OMS) Specification - OpenSSF blog, Jun 2025\n  https://openssf.org/blog/2025/06/25/an-introduction-to-the-openssf-model-signing-oms-specification/\n- Case Study: Google Secures ML Models with Sigstore - OpenSSF, Jul 2025\n  https://openssf.org/blog/2025/07/23/case-study-google-secures-machine-learning-models-with-sigstore/\n- Model authenticity and transparency with Sigstore - Red Hat, Apr 2025\n  https://next.redhat.com/2025/04/10/model-authenticity-and-transparency-with-sigstore/\n- Taming the Wild West of ML: Practical Model Signing with Sigstore \u2014 Sigstore blog\n  https://blog.sigstore.dev/model-transparency-v1.0/\n- model-signing on PyPI\n  https://pypi.org/project/model-signing/\n\n**SafeTensors:**\n- SafeTensors joins the PyTorch Foundation - Hugging Face blog, Mar 2026\n  https://huggingface.co/blog/safetensors-joins-pytorch-foundation\n- PyTorch Foundation announcement - PR Newswire, Apr 2026\n  https://www.prnewswire.com/news-releases/pytorch-foundation-announces-safetensors-as-newest-contributed-project-to-secure-ai-model-execution-302736068.html\n- SafeTensors - official PyTorch ecosystem page\n  https://pytorch.org/projects/safetensors/\n\n**Malicious models on Hugging Face:**\n- ReversingLabs identifies malware ML model on Hugging Face (*nullifAI*) - Feb 2025\n  https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face\n- The Poisoned Model Registry: Hugging Face as Malware Distribution Channel - Lyrie Research, 2026\n  https://lyrie.ai/research/research/huggingface-model-supply-chain-nullifai-pickle-rce\n- Malicious AI Model Repositories Attack Surface - Cloud Security Alliance\n  https://labs.cloudsecurityalliance.org/research/csa-research-note-malicious-ai-model-repositories-attack-sur/\n- Poisoned AI: How Hugging Face Became a Malware Distribution Platform - Hive Security, 2026\n  https://hivesecurity.gitlab.io/blog/huggingface-ai-supply-chain-attacks-2026/\n\n\n---\n\n## About Me\n\nSenior Software Engineer at Red Hat. Builds Python and Go systems for RHEL and OpenShift; works on rule-driven diagnostics engines, multi-agent workflows, and more recently harness engineering.\n\n- GitHub: https://github.com/rahulXs\n- Slides PDF: Upcoming\n\nQuestions about the talk? Leave a comment on this gist, I'll try to answer.\n", "url": "https://gist.github.com/rahulXs/33981c9d91701115bb44ac406396c782"}, {"timestamp": "2026-09-04T00:36:24Z", "date_only": false, "value": "2026-09-04T00:36:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-PYTORCH-2026-24747", "record": "BIT-PYTORCH-2026-24747", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-17T09:39:32Z", "date_only": false, "value": "2026-10-17T09:39:32Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-24747", "record": "UBUNTU-CVE-2026-24747", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-04T03:06:46Z", "date_only": false, "value": "2026-11-04T03:06:46Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-63CW-57P8-FM3P", "record": "GHSA-63CW-57P8-FM3P", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": true, "value": "2026-11-06", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1486", "record": "CERTFR-2026-AVI-1486", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1486", "record": "CERTFR-2026-AVI-1486", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1486", "record": "CERTFR-2026-AVI-1486", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1486", "record": "CERTFR-2026-AVI-1486", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-13T17:35:14Z", "date_only": false, "value": "2026-11-13T17:35:14+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T17:35:14Z", "date_only": false, "value": "2026-11-13T17:35:14+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T17:35:14Z", "date_only": false, "value": "2026-11-13T17:35:14+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "document.tracking.current_release_date", "linked_record": true}], "metrics": {"as_of": "2026-11-13T19:14:52.961Z", "anchors": {"origin": {"timestamp": "2026-01-26T23:00:00Z", "date_only": false, "value": "2026-01-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": {"timestamp": "2026-01-27T22:01:52.649Z", "date_only": false, "value": "2026-01-27T22:01:52.649884+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-01-26T23:00:00Z", "date_only": false, "value": "2026-01-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-06-10T04:27:13Z", "date_only": false, "value": "2026-06-10T04:27:13+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": 11514320.351, "hours": 3198.4223197222223, "days": 133.2675966550926, "min_seconds": 11514320.351, "max_seconds": 11514320.351, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-01-27T22:01:52.649Z", "date_only": false, "value": "2026-01-27T22:01:52.649884+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-06-10T04:27:13Z", "date_only": false, "value": "2026-06-10T04:27:13+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, "discovery_after_disclosure": true}, "disclosure_to_patch": {"available": true, "seconds": 11597233.0, "hours": 3221.453611111111, "days": 134.2272337962963, "min_seconds": 11597233.0, "max_seconds": 11597233.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-01-26T23:00:00Z", "date_only": false, "value": "2026-01-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-06-10T04:27:13Z", "date_only": false, "value": "2026-06-10T04:27:13+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 11597233.0, "hours": 3221.453611111111, "days": 134.2272337962963, "min_seconds": 11597233.0, "max_seconds": 11597233.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-01-26T23:00:00Z", "date_only": false, "value": "2026-01-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0222", "record": "WID-SEC-W-2026-0222", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-06-10T04:27:13Z", "date_only": false, "value": "2026-06-10T04:27:13+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:24977", "record": "RHSA-2026:24977", "field": "vulnerabilities.10.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}