{"metadata": {"vulnerability": "CVE-2026-94099", "count": 18, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-09-20T00:00:00Z", "date_only": false, "value": "2026-09-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-94099", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-09-20T02:00:00Z", "date_only": false, "value": "2026-09-20T02:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-94099", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-09-20T09:19:09.259Z", "date_only": false, "value": "2026-09-20T09:19:09.259Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-94099", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-20T11:24:42Z", "date_only": false, "value": "2026-09-20T11:24:42.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-94099", "field": "containers.cna.timeline.2.time"}, {"timestamp": "2026-09-21T00:15:06.412Z", "date_only": false, "value": "2026-09-21T00:15:06.412Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94099", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-21T00:15:06.412Z", "date_only": false, "value": "2026-09-21T00:15:06.412Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2026-94099", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-21T01:16:29Z", "date_only": false, "value": "2026-09-21T01:16:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-25M6-M9Q2-9CPX", "record": "GHSA-25M6-M9Q2-9CPX", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-21T01:16:29.983Z", "date_only": false, "value": "2026-09-21T01:16:29.983", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94099", "record": "FKIE_CVE-2026-94099", "field": "published"}, {"timestamp": "2026-09-21T03:30:20Z", "date_only": false, "value": "2026-09-21T03:30:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-25M6-M9Q2-9CPX", "record": "GHSA-25M6-M9Q2-9CPX", "field": "published"}, {"timestamp": "2026-09-21T03:30:20Z", "date_only": false, "value": "2026-09-21T03:30:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-25M6-M9Q2-9CPX", "record": "GHSA-25M6-M9Q2-9CPX", "field": "modified"}, {"timestamp": "2026-09-21T13:30:29.345Z", "date_only": false, "value": "2026-09-21T13:30:29.345042Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117309271481222891", "record": "cve-2026-94099", "field": "creation_timestamp", "uuid": "ba03a37d-bc9f-47de-a46a-a614c3324c55", "content": "CVE-2026-94099 | Netcore NBR200V2 (1.3.241127.071246): CRITICAL command injection via restore.cgi (QUERY_STRING). Remote exploit, no patch, vendor silent. Isolate devices & monitor logs. https://radar.offseq.com/threat/cve-2026-94099-command-injection-in-netcore-nbr200v2-adc35b079f75e0e5 #OffSeq #Netcore #CVE202694099 #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117309271481222891"}, {"timestamp": "2026-09-21T13:30:31.534Z", "date_only": false, "value": "2026-09-21T13:30:31.534657Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvzt2jhqcc2x", "record": "cve-2026-94099", "field": "creation_timestamp", "uuid": "d2fd2949-1d0d-4b16-b80d-095d8742ceb1", "content": "Netcore NBR200V2 firmware 1.3.241127.071246 faces CRITICAL remote command injection (CVE-2026-94099, CVSS 9.4). Public exploit, no patch. Isolate & monitor systems now. https://radar.offseq.com/threat/cve-2026-94099-command-injection-in-netcore-nbr200v2-adc35b079f75e0e5 #OffSeq #Netcore #Vulnerab...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mvzt2jhqcc2x"}, {"timestamp": "2026-09-22T15:36:30.858Z", "date_only": false, "value": "2026-09-22T15:36:30.858869Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94099", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-22T15:36:30.858Z", "date_only": false, "value": "2026-09-22T15:36:30.858869Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94099", "record": "FKIE_CVE-2026-94099", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-22T15:41:49.645Z", "date_only": false, "value": "2026-09-22T15:41:49.645Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-94099", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-22T15:41:49.645Z", "date_only": false, "value": "2026-09-22T15:41:49.645Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94099", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-22T16:18:17.183Z", "date_only": false, "value": "2026-09-22T16:18:17.183", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94099", "record": "FKIE_CVE-2026-94099", "field": "lastModified"}, {"timestamp": "2026-10-19T17:50:06.359Z", "date_only": false, "value": "2026-10-19T17:50:06.359978Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117468836880151129", "record": "CVE-2026-94099", "field": "creation_timestamp", "uuid": "0a344f0a-a43a-4164-af2e-11a1566928e1", "content": "CVE-2026-94099: command injection in Netcore NBR200V2 backup restore (QUERY_STRING), CVSS 9.9, remote, public exploit, no vendor response and no patch. Restrict expose of restore.cgi at once. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94099/", "url": "https://mastodon.social/users/hugovalters/statuses/117468836880151129"}]}