{"metadata": {"vulnerability": "cve-2026-108947", "count": 16, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-10-11T00:00:00Z", "date_only": false, "value": "2026-10-11T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "cve-2026-108947", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-11T02:00:00Z", "date_only": false, "value": "2026-10-11T02:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "cve-2026-108947", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-11T18:58:36.698Z", "date_only": false, "value": "2026-10-11T18:58:36.698Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-108947", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T21:03:43Z", "date_only": false, "value": "2026-10-11T21:03:43.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "cve-2026-108947", "field": "containers.cna.timeline.2.time"}, {"timestamp": "2026-10-13T01:00:19.241Z", "date_only": false, "value": "2026-10-13T01:00:19.241Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-108947", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T01:00:19.241Z", "date_only": false, "value": "2026-10-13T01:00:19.241Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "cve-2026-108947", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T02:00:39.945Z", "date_only": false, "value": "2026-10-13T02:00:39.945281Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117431129822750751", "record": "CVE-2026-108947", "field": "creation_timestamp", "uuid": "54ad0e7b-dd67-49db-9295-abd6306039eb", "content": "CVE-2026-108947 yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: \"This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate.\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-108947https://vuldb.com/vuln/416771https://vuldb.com/vuln/416771/ctihttps://vuldb.com/cve/CVE-2026-108947https://vuldb.com/submit/997819https://github.com/yoshitomo-matsubara/torchdistill/issues/550https://github.com/yoshitomo-matsubara/torchdistill/issues/550#issuecomment-5826644846https://github.com/yoshitomo-matsubara/torchdistill/#yoshitomo-matsubara #torchdistill#CVE_2026_108947#bot", "url": "https://infosec.exchange/users/cve/statuses/117431129822750751"}, {"timestamp": "2026-10-13T02:16:57Z", "date_only": false, "value": "2026-10-13T02:16:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M93M-2X62-W23P", "record": "GHSA-M93M-2X62-W23P", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T02:16:57.127Z", "date_only": false, "value": "2026-10-13T02:16:57.127", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108947", "record": "FKIE_CVE-2026-108947", "field": "published"}, {"timestamp": "2026-10-13T03:30:34Z", "date_only": false, "value": "2026-10-13T03:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M93M-2X62-W23P", "record": "GHSA-M93M-2X62-W23P", "field": "published"}, {"timestamp": "2026-10-13T03:30:34Z", "date_only": false, "value": "2026-10-13T03:30:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M93M-2X62-W23P", "record": "GHSA-M93M-2X62-W23P", "field": "modified"}, {"timestamp": "2026-10-13T13:23:18.676Z", "date_only": false, "value": "2026-10-13T13:23:18.676012Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108947", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T13:23:18.676Z", "date_only": false, "value": "2026-10-13T13:23:18.676012Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108947", "record": "FKIE_CVE-2026-108947", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T13:23:31.723Z", "date_only": false, "value": "2026-10-13T13:23:31.723Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-108947", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:23:31.723Z", "date_only": false, "value": "2026-10-13T13:23:31.723Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108947", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T14:17:24.113Z", "date_only": false, "value": "2026-10-13T14:17:24.113", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108947", "record": "FKIE_CVE-2026-108947", "field": "lastModified"}]}