{"metadata": {"vulnerability": "cve-2026-109360", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109360", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:21:32.594Z", "date_only": false, "value": "2026-10-12T14:21:32.594Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109360", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:05:39.587Z", "date_only": false, "value": "2026-10-12T16:05:39.587Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109360", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:05:39.587Z", "date_only": false, "value": "2026-10-12T16:05:39.587Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109360", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T17:17:33Z", "date_only": false, "value": "2026-10-12T17:17:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FVR7-75WP-4566", "record": "GHSA-FVR7-75WP-4566", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:33.480Z", "date_only": false, "value": "2026-10-12T17:17:33.480", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109360", "record": "FKIE_CVE-2026-109360", "field": "published"}, {"timestamp": "2026-10-12T17:49:34.478Z", "date_only": false, "value": "2026-10-12T17:49:34.478017Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429198783197698", "record": "CVE-2026-109360", "field": "creation_timestamp", "uuid": "c26cc6fd-4263-47fb-bfde-5a544f643b1b", "content": "CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109360https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-vm9c-7j6g-c7mmhttps://www.vulncheck.com/advisories/monai-0.4.0-before-1.6.1-rce-via-senet-pretrained-weights-over-plaintext-http#Project-MONAI #MONAI#CVE_2026_109360#bot", "url": "https://infosec.exchange/users/cve/statuses/117429198783197698"}, {"timestamp": "2026-10-12T18:31:53Z", "date_only": false, "value": "2026-10-12T18:31:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FVR7-75WP-4566", "record": "GHSA-FVR7-75WP-4566", "field": "published"}, {"timestamp": "2026-10-12T18:31:53Z", "date_only": false, "value": "2026-10-12T18:31:53Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FVR7-75WP-4566", "record": "GHSA-FVR7-75WP-4566", "field": "modified"}, {"timestamp": "2026-10-13T05:10:04.767Z", "date_only": false, "value": "2026-10-13T05:10:04.767518Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxqbdwjiwz27", "record": "CVE-2026-109360", "field": "creation_timestamp", "uuid": "1014762b-1924-4b38-b21f-729825869332", "content": "CVE-2026-109360\nVersions of MONAI before 1.6.1 download model data over an unencrypted connection. An attacker who can alter that traffic could replace the file with malicious code, which is then executed when a pretrained\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxqbdwjiwz27"}, {"timestamp": "2026-10-13T17:28:59.839Z", "date_only": false, "value": "2026-10-13T17:28:59.839516Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109360", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T17:28:59.839Z", "date_only": false, "value": "2026-10-13T17:28:59.839516Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109360", "record": "FKIE_CVE-2026-109360", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T17:29:37.331Z", "date_only": false, "value": "2026-10-13T17:29:37.331Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109360", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T17:29:37.331Z", "date_only": false, "value": "2026-10-13T17:29:37.331Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109360", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T18:17:20.010Z", "date_only": false, "value": "2026-10-13T18:17:20.010", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109360", "record": "FKIE_CVE-2026-109360", "field": "lastModified"}]}