{"metadata": {"vulnerability": "CVE-2026-94434", "count": 19, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-21T16:19:11.619Z", "date_only": false, "value": "2026-09-21T16:19:11.619Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-94434", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-09T12:11:00Z", "date_only": false, "value": "2026-11-09T12:11:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / TR-CERT", "record": "CVE-2026-94434", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T12:13:34.141Z", "date_only": false, "value": "2026-11-09T12:13:34.141Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94434", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T12:13:34.141Z", "date_only": false, "value": "2026-11-09T12:13:34.141Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / TR-CERT", "record": "CVE-2026-94434", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T12:23:51.861Z", "date_only": false, "value": "2026-11-09T12:23:51.861911Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117586462732510826", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "d8ad5e27-7bd7-440a-95af-8d23c260bad8", "content": "CVE-2026-94434 OS Command Injection Leading to Root Code Execution in T\u00dcB\u0130TAK B\u0130LGEM's Pardus Boot Repair Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\nThis issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94434https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1486#T\u00dcB\u0130TAKB\u0130LGEMSoftwareTechnologiesResearchInstitute #PardusBootRepair#CVE_2026_94434#bot", "url": "https://infosec.exchange/users/cve/statuses/117586462732510826"}, {"timestamp": "2026-11-09T13:03:26Z", "date_only": false, "value": "2026-11-09T13:03:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109800", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "51002955-2a71-4e3c-94c0-f86a9be5eec6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94434\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 12:57:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPardus Boot Repair Btrfs subvolume command injection: research, proof of concept, and demonstration video for CVE-2026-94434.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109800", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-09T13:03:26Z", "date_only": false, "value": "2026-11-09T13:03:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/109800", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "2ebe3d9d-89a6-415d-8c6e-a294e8e16069", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94434\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 12:57:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPardus Boot Repair Btrfs subvolume command injection: research, proof of concept, and demonstration video for CVE-2026-94434.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109800"}, {"timestamp": "2026-11-09T13:17:09Z", "date_only": false, "value": "2026-11-09T13:17:09Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J7P9-P82M-JQXH", "record": "GHSA-J7P9-P82M-JQXH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T13:17:09.273Z", "date_only": false, "value": "2026-11-09T13:17:09.273", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94434", "record": "FKIE_CVE-2026-94434", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T13:25:45.217Z", "date_only": false, "value": "2026-11-09T13:25:45.217448Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d3sa3s7ki34ki", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "91c23a76-38f7-417f-b56f-0a839c764f4d", "content": "CVE-2026-94434 - OS Command Injection Leading to Root Code Execution in T\u00dcB\u0130TAK B\u0130LGEM's Pardus Boot Repair\nCVE ID : CVE-2026-94434\n \n Published : Nov. 9, 2026, 12:13 p.m. | 1\u00a0hour, 1\u00a0minute ago\n \n Description : Improper neutralization of special elements used in an OS command...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/d3sa3s7ki34ki"}, {"timestamp": "2026-11-09T13:46:20.889Z", "date_only": false, "value": "2026-11-09T13:46:20.889535Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzv2rwdm322k", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "946f712f-c0a9-48bb-8af2-a554e66f2aec", "content": "\ud83d\udfe0 CVE-2026-94434 - High (8.8)\n\nImproper neutralization of special elements used in an OS command ('OS command injection') vulner...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-94434/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzv2rwdm322k"}, {"timestamp": "2026-11-09T14:01:57Z", "date_only": false, "value": "2026-11-09T14:01:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109813", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "5e863b19-449d-40e6-b841-770367118d83", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94434\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 13:22:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPardus Boot Repair Btrfs subvolume command injection: research, proof of concept, and demonstration video for CVE-2026-94434.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109813", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-09T15:05:11.230Z", "date_only": false, "value": "2026-11-09T15:05:11.230726Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94434", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T15:05:11.230Z", "date_only": false, "value": "2026-11-09T15:05:11.230726Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94434", "record": "FKIE_CVE-2026-94434", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-09T15:23:53.113Z", "date_only": false, "value": "2026-11-09T15:23:53.113Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-94434", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T15:23:53.113Z", "date_only": false, "value": "2026-11-09T15:23:53.113Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94434", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T15:32:09Z", "date_only": false, "value": "2026-11-09T15:32:09Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J7P9-P82M-JQXH", "record": "GHSA-J7P9-P82M-JQXH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T15:32:09Z", "date_only": false, "value": "2026-11-09T15:32:09Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J7P9-P82M-JQXH", "record": "GHSA-J7P9-P82M-JQXH", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T16:17:35.360Z", "date_only": false, "value": "2026-11-09T16:17:35.360", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94434", "record": "FKIE_CVE-2026-94434", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T02:51:10.297Z", "anchors": {"origin": {"timestamp": "2026-11-09T12:11:00Z", "date_only": false, "value": "2026-11-09T12:11:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / TR-CERT", "record": "CVE-2026-94434", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-09T12:11:00Z", "date_only": false, "value": "2026-11-09T12:11:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / TR-CERT", "record": "CVE-2026-94434", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-09T13:03:26Z", "date_only": false, "value": "2026-11-09T13:03:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109800", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "51002955-2a71-4e3c-94c0-f86a9be5eec6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94434\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 12:57:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPardus Boot Repair Btrfs subvolume command injection: research, proof of concept, and demonstration video for CVE-2026-94434.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109800", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3146.0, "hours": 0.8738888888888889, "days": 0.036412037037037034, "min_seconds": 3146.0, "max_seconds": 3146.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T12:11:00Z", "date_only": false, "value": "2026-11-09T12:11:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / TR-CERT", "record": "CVE-2026-94434", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-09T13:03:26Z", "date_only": false, "value": "2026-11-09T13:03:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109800", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "51002955-2a71-4e3c-94c0-f86a9be5eec6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94434\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 12:57:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPardus Boot Repair Btrfs subvolume command injection: research, proof of concept, and demonstration video for CVE-2026-94434.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109800", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 52810.297014, "hours": 14.669526948333335, "days": 0.6112302895138889, "min_seconds": 52810.297014, "max_seconds": 52810.297014, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T12:11:00Z", "date_only": false, "value": "2026-11-09T12:11:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / TR-CERT", "record": "CVE-2026-94434", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T02:51:10.297Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 49664.297014, "hours": 13.795638059444446, "days": 0.5748182524768519, "min_seconds": 49664.297014, "max_seconds": 49664.297014, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T13:03:26Z", "date_only": false, "value": "2026-11-09T13:03:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109800", "record": "CVE-2026-94434", "field": "creation_timestamp", "uuid": "51002955-2a71-4e3c-94c0-f86a9be5eec6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94434\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 12:57:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPardus Boot Repair Btrfs subvolume command injection: research, proof of concept, and demonstration video for CVE-2026-94434.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109800", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-10T02:51:10.297Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}