{"metadata": {"vulnerability": "CVE-2026-94488", "count": 17, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-21T17:29:01Z", "date_only": false, "value": "2026-09-21T17:29:01.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-94488", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-21T17:29:01.776Z", "date_only": false, "value": "2026-09-21T17:29:01.776Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94488", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-21T17:29:01.776Z", "date_only": false, "value": "2026-09-21T17:29:01.776Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2026-94488", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-21T17:51:08.525Z", "date_only": false, "value": "2026-09-21T17:51:08.525648Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94488", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-21T17:51:08.525Z", "date_only": false, "value": "2026-09-21T17:51:08.525648Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94488", "record": "FKIE_CVE-2026-94488", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-21T17:51:18.874Z", "date_only": false, "value": "2026-09-21T17:51:18.874Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-94488", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-21T17:51:18.874Z", "date_only": false, "value": "2026-09-21T17:51:18.874Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94488", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-21T18:17:17Z", "date_only": false, "value": "2026-09-21T18:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-58P4-4G24-J8VP", "record": "GHSA-58P4-4G24-J8VP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-21T18:17:17.173Z", "date_only": false, "value": "2026-09-21T18:17:17.173", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94488", "record": "FKIE_CVE-2026-94488", "field": "published"}, {"timestamp": "2026-09-21T18:18:43.775Z", "date_only": false, "value": "2026-09-21T18:18:43.775141Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4rbg2usddcdnl", "record": "CVE-2026-94488", "field": "creation_timestamp", "uuid": "45921612-608f-43f3-8509-35887889a9e9", "content": "CVE-2026-94488 - Telegram Desktop Cross-Site Scripting Vulnerability\nCVE ID : CVE-2026-94488\n \n Published : Sept. 21, 2026, 5:29 p.m. | 11\u00a0minutes ago\n \n Description : Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) Thi...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/4rbg2usddcdnl"}, {"timestamp": "2026-09-21T18:32:09Z", "date_only": false, "value": "2026-09-21T18:32:09Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-58P4-4G24-J8VP", "record": "GHSA-58P4-4G24-J8VP", "field": "published"}, {"timestamp": "2026-09-21T18:32:09Z", "date_only": false, "value": "2026-09-21T18:32:09Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-58P4-4G24-J8VP", "record": "GHSA-58P4-4G24-J8VP", "field": "modified"}, {"timestamp": "2026-09-22T12:15:02.603Z", "date_only": false, "value": "2026-09-22T12:15:02.603626Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-94488", "record": "CVE-2026-94488", "field": "creation_timestamp", "uuid": "de23b478-50f2-480a-8fb3-9d1b68ed3af4", "url": "https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-94488"}, {"timestamp": "2026-09-22T19:56:19.073Z", "date_only": false, "value": "2026-09-22T19:56:19.073", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94488", "record": "FKIE_CVE-2026-94488", "field": "lastModified"}, {"timestamp": "2026-09-23T01:00:43.320Z", "date_only": false, "value": "2026-09-23T01:00:43.320282Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-94488", "record": "CVE-2026-94488", "field": "creation_timestamp", "uuid": "ca9839b2-3619-457d-9fc4-29672984baac", "content": "Disponibile una Proof of Concept (PoC) per lo sfruttamento della CVE-2026-94488 - gi\u00e0 sanata dal vendor - presente in Telegram Desktop, client desktop dell'omonima piattaforma di messaggistica. Tale vulnerabilit\u00e0 potrebbe consentire a un utente malintenzionato remoto di eludere i meccanismi di sicurezza sui sistemi interessati.", "url": "https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-94488"}, {"timestamp": "2026-10-15T21:20:03.953Z", "date_only": false, "value": "2026-10-15T21:20:03.953005Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mxwyi7hbqk2m", "record": "CVE-2026-94488", "field": "creation_timestamp", "uuid": "5f955e0d-3f21-4753-8666-0caad90795b7", "content": "CVE-2026-94488 Telegram Desktop XSS in HTML exporter, CVSS 8.2. Fixed in 7.0.1, no patch cleared yet. Update now if you use HTML export. https://www.valtersit.com/cve/CVE-2026-94488/ #CVE #infosec #Telegram", "url": "https://bsky.app/profile/hugovalters.bsky.social/post/3mxwyi7hbqk2m"}, {"timestamp": "2026-10-15T21:21:08.657Z", "date_only": false, "value": "2026-10-15T21:21:08.657450Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117447013411839471", "record": "CVE-2026-94488", "field": "creation_timestamp", "uuid": "ee98d491-88cf-4bfd-b6f8-b22be66881a5", "content": "CVE-2026-94488 Telegram Desktop XSS in HTML exporter, CVSS 8.2. Fixed in 7.0.1, no patch cleared yet. Update now if you use HTML export. https://www.valtersit.com/cve/CVE-2026-94488/ #CVE #infosec #Telegram", "url": "https://mastodon.social/users/hugovalters/statuses/117447013411839471"}]}