{"metadata": {"vulnerability": "CVE-2026-44666", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-05-07T16:20:08.659Z", "date_only": false, "value": "2026-05-07T16:20:08.659Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-44666", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-14T20:32:43.490Z", "date_only": false, "value": "2026-05-14T20:32:43.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44666", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-14T20:32:43.490Z", "date_only": false, "value": "2026-05-14T20:32:43.490Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-44666", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-14T21:16:47.370Z", "date_only": false, "value": "2026-05-14T21:16:47.370", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-44666", "record": "FKIE_CVE-2026-44666", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-15T00:00:39.172Z", "date_only": false, "value": "2026-05-15T00:00:39.172344Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mltznm4m4d2f", "record": "cve-2026-44666", "field": "creation_timestamp", "uuid": "533cd363-4163-4144-8cf1-aeec1d2c1ce2", "content": "CRITICAL: OS command injection in zelon88 HRConvert2 < 3.3.8 lets attackers run arbitrary OS commands. Upgrade to 3.3.8 ASAP to secure your systems! https://radar.offseq.com/threat/cve-2026-44666-cwe-78-improper-neutralization-of-s-fac9c425 #OffSeq #Vulnerability #SecurityAlert", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mltznm4m4d2f"}, {"timestamp": "2026-05-15T00:00:58.285Z", "date_only": false, "value": "2026-05-15T00:00:58.285191Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116575648891629346", "record": "cve-2026-44666", "field": "creation_timestamp", "uuid": "567d1fbc-9301-45d8-a3d5-db481e34ca5c", "content": "\u26a0\ufe0f CRITICAL: CVE-2026-44666 in zelon88 HRConvert2 (< 3.3.8) enables OS command injection via unsafe sanitizeString() handling of backtick & tab chars. Patch to 3.3.8 ASAP. Impact: full server compromise possible. Details: https://radar.offseq.com/threat/cve-2026-44666-cwe-78-improper-neutralization-of-s-fac9c425 #OffSeq #Vuln #Infosec", "url": "https://infosec.exchange/users/offseq/statuses/116575648891629346"}, {"timestamp": "2026-05-15T01:47:07.602Z", "date_only": false, "value": "2026-05-15T01:47:07.602522Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlu7lyx2bd2h", "record": "CVE-2026-44666", "field": "creation_timestamp", "uuid": "128c4fa2-bf21-4dac-a6e7-9896c0babbc5", "content": "CVE-2026-44666 - HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution\nCVE ID : CVE-2026-44666\n \n Published : May 14, 2026, 9:16 p.m. | 2\u00a0hours, 17\u00a0minutes ago\n \n Description : HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion s...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlu7lyx2bd2h"}, {"timestamp": "2026-05-15T13:34:44.637Z", "date_only": false, "value": "2026-05-15T13:34:44.637167Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-44666", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-05-15T13:34:44.637Z", "date_only": false, "value": "2026-05-15T13:34:44.637167Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-44666", "record": "FKIE_CVE-2026-44666", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-05-15T13:34:48.461Z", "date_only": false, "value": "2026-05-15T13:34:48.461Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-44666", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-15T13:34:48.461Z", "date_only": false, "value": "2026-05-15T13:34:48.461Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-44666", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T14:10:00.130Z", "date_only": false, "value": "2026-10-26T14:10:00.130", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-44666", "record": "FKIE_CVE-2026-44666", "field": "lastModified"}], "metrics": {"as_of": "2026-10-30T06:50:14.402Z", "anchors": {"origin": {"timestamp": "2026-05-14T20:32:43.490Z", "date_only": false, "value": "2026-05-14T20:32:43.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44666", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-14T20:32:43.490Z", "date_only": false, "value": "2026-05-14T20:32:43.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44666", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 14552250.912286, "hours": 4042.2919200794445, "days": 168.4288300033102, "min_seconds": 14552250.912286, "max_seconds": 14552250.912286, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-14T20:32:43.490Z", "date_only": false, "value": "2026-05-14T20:32:43.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44666", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T06:50:14.402Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}