{"metadata": {"vulnerability": "CVE-2026-73695", "count": 15, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-08-13T15:15:54.513Z", "date_only": false, "value": "2026-08-13T15:15:54.513Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73695", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73695", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T14:51:47.891Z", "date_only": false, "value": "2026-11-02T14:51:47.891Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73695", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T15:17:37Z", "date_only": false, "value": "2026-11-02T15:17:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M2M4-55X5-X967", "record": "GHSA-M2M4-55X5-X967", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-02T15:17:37.287Z", "date_only": false, "value": "2026-11-02T15:17:37.287", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73695", "record": "FKIE_CVE-2026-73695", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T15:29:31.009Z", "date_only": false, "value": "2026-11-02T15:29:31.009564Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117547459048270245", "record": "CVE-2026-73695", "field": "creation_timestamp", "uuid": "ae254d65-d6f4-4447-9e40-d689348b5b24", "content": "CVE-2026-73695 Control Web Panel (CWP) < 1.16 Path Traversal LFI via module Parameter Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.\nhttps://www.cve.org/CVERecord?id=CVE-2026-73695https://control-webpanel.com/changeloghttps://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-lfi-via-module-parameter#ControlWebPanel#CVE_2026_73695#bot", "url": "https://infosec.exchange/users/cve/statuses/117547459048270245"}, {"timestamp": "2026-11-02T15:31:50Z", "date_only": false, "value": "2026-11-02T15:31:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M2M4-55X5-X967", "record": "GHSA-M2M4-55X5-X967", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:29:15.633Z", "date_only": false, "value": "2026-11-02T16:29:15.633259Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117547762226113068", "record": "cve-2026-73695", "field": "creation_timestamp", "uuid": "9d5041b7-ac2d-420e-9ebc-c022472ce8a3", "content": "Maybe go hack and patch some CWP if you are into that sort of thing.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-73695\nhttps://nvd.nist.gov/vuln/detail/cve-2026-73696\nhttps://nvd.nist.gov/vuln/detail/cve-2026-73697", "url": "https://infosec.exchange/users/cR0w/statuses/117547762226113068"}, {"timestamp": "2026-11-02T19:58:04.005Z", "date_only": false, "value": "2026-11-02T19:58:04.005409Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/aan7itmt743dq", "record": "CVE-2026-73695", "field": "creation_timestamp", "uuid": "08ecd2f0-47f7-4ac9-920e-b538a9efc8e9", "content": "\ud83d\udea8 CVE-2026-73695\nCVSS 8.8 / KEV: No\nTL;DR: Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated\u2026\nhttps://cvesentinel.com/report/CVE-2026-73695\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/aan7itmt743dq"}, {"timestamp": "2026-11-03T14:17:37.140Z", "date_only": false, "value": "2026-11-03T14:17:37.140", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73695", "record": "FKIE_CVE-2026-73695", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T15:31:43Z", "date_only": false, "value": "2026-11-03T15:31:43Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M2M4-55X5-X967", "record": "GHSA-M2M4-55X5-X967", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T17:00:18.033Z", "date_only": false, "value": "2026-11-03T17:00:18.033Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73695", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T17:00:18.033Z", "date_only": false, "value": "2026-11-03T17:00:18.033Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73695", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T01:47:28.801Z", "date_only": false, "value": "2026-11-05T01:47:28.801809Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzjqqsp2ab2f", "record": "CVE-2026-73695", "field": "creation_timestamp", "uuid": "38e0e7a7-377c-4bce-bb74-796f41f0d278", "content": "Update Control Web Panel to version 1.29 now to patch CVE-2026-73695, CVE-2026-73696, and eight other flaws allowing unauthenticated root RCE.\n\n#ControlWebPanel #CWP #Linux #Cybersecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzjqqsp2ab2f"}, {"timestamp": "2026-11-05T20:42:27.501Z", "date_only": false, "value": "2026-11-05T20:42:27.501878Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mzlq6ddstg2l", "record": "CVE-2026-73695", "field": "creation_timestamp", "uuid": "9ae2b3bc-9517-400c-8f30-5479a43e2561", "content": "CVE-2026-73695 is trending. Hype score 2, currently #6 on cvemon.\n\nControl Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-73695", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mzlq6ddstg2l"}], "metrics": {"as_of": "2026-11-06T14:34:44.748Z", "anchors": {"origin": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73695", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73695", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 398084.748975, "hours": 110.5790969375, "days": 4.607462372395833, "min_seconds": 311684.748975, "max_seconds": 398084.748975, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-73695", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T14:34:44.748Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}