{"metadata": {"vulnerability": "CVE-2026-61645", "count": 13, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-07-10T17:38:57.112Z", "date_only": false, "value": "2026-07-10T17:38:57.112Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61645", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T21:17:37.532Z", "date_only": false, "value": "2026-10-29T21:17:37.532Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61645", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T21:17:37.532Z", "date_only": false, "value": "2026-10-29T21:17:37.532Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61645", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T21:24:33.712Z", "date_only": false, "value": "2026-10-29T21:24:33.712985Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117526303426163561", "record": "CVE-2026-61645", "field": "creation_timestamp", "uuid": "36b90b62-fa4b-4ad0-a95c-d169e88a26c3", "content": "CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.\nhttps://www.cve.org/CVERecord?id=CVE-2026-61645https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crwhttps://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fdhttps://github.com/docat-org/docat/releases/tag/1.6.0#docat-org #docat#CVE_2026_61645#bot", "url": "https://infosec.exchange/users/cve/statuses/117526303426163561"}, {"timestamp": "2026-10-29T22:17:04.963Z", "date_only": false, "value": "2026-10-29T22:17:04.963", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61645", "record": "FKIE_CVE-2026-61645", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T22:30:05.941Z", "date_only": false, "value": "2026-10-29T22:30:05.941484Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz2cwehcln2v", "record": "CVE-2026-61645", "field": "creation_timestamp", "uuid": "33544bc6-02c6-49e2-af3e-7950eb882c09", "content": "CVE-2026-61645\nThe Docat documentation hosting tool lets anyone upload files without checking their name or type. An attacker could replace important configuration files or drop malicious code on the server, which could lead\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz2cwehcln2v"}, {"timestamp": "2026-10-30T00:07:14.526Z", "date_only": false, "value": "2026-10-30T00:07:14.526149Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz2ie2lktg2w", "record": "CVE-2026-61645", "field": "creation_timestamp", "uuid": "f91391dd-9f25-41cd-a864-fd18a87421db", "content": "\ud83d\udea8 CVE-2026-61645 \u2014 CVSS 9.1 CRITICAL\n\nDocat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary fi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61645\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz2ie2lktg2w"}, {"timestamp": "2026-10-30T03:46:32.175Z", "date_only": false, "value": "2026-10-30T03:46:32.175246Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz2um5ncan2s", "record": "CVE-2026-61645", "field": "creation_timestamp", "uuid": "01f480af-c724-40ae-a253-938eeb15834c", "content": "\ud83d\udd34 CVE-2026-61645 - Critical (9.1)\n\nDocat is a tool for hosting versioned static documentation. In the affected implementation, an ar...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61645/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz2um5ncan2s"}, {"timestamp": "2026-10-30T15:20:45.317Z", "date_only": false, "value": "2026-10-30T15:20:45.317186Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61645", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-30T15:20:45.317Z", "date_only": false, "value": "2026-10-30T15:20:45.317186Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61645", "record": "FKIE_CVE-2026-61645", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-30T15:59:29.551Z", "date_only": false, "value": "2026-10-30T15:59:29.551Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61645", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T15:59:29.551Z", "date_only": false, "value": "2026-10-30T15:59:29.551Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61645", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T19:39:14.897Z", "date_only": false, "value": "2026-10-30T19:39:14.897", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61645", "record": "FKIE_CVE-2026-61645", "field": "lastModified"}], "metrics": {"as_of": "2026-11-01T08:20:26.719Z", "anchors": {"origin": {"timestamp": "2026-10-29T21:17:37.532Z", "date_only": false, "value": "2026-10-29T21:17:37.532Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61645", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-29T21:17:37.532Z", "date_only": false, "value": "2026-10-29T21:17:37.532Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61645", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 212569.187949, "hours": 59.046996652500006, "days": 2.4602915271875, "min_seconds": 212569.187949, "max_seconds": 212569.187949, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-29T21:17:37.532Z", "date_only": false, "value": "2026-10-29T21:17:37.532Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61645", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T08:20:26.719Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}