{"vulnerability": "cve-2026-40281", "sightings": [{"uuid": "b7a04544-8b53-4446-ae5b-372e7ec3e455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7onz4kgp2n", "content": "\ud83d\udd34 CVE-2026-40281 - Critical (10)\n\nGotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the me...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-40281/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-06T21:50:46.950815Z"}, {"uuid": "4a6f64c9-be06-4a6b-9e5f-28c9b436b339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mla4iyvhh22o", "content": "CVE-2026-40281 - Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values\nCVE ID : CVE-2026-40281\n \n Published : May 6, 2026, 9:16 p.m. | 3\u00a0hours, 4\u00a0minutes ago\n \n Description : Gotenberg is a Docker-powered stateless API for PDF files. In versions 8...", "creation_timestamp": "2026-05-07T01:58:30.976420Z"}, {"uuid": "5b9fb60b-25f8-414c-bebf-35f9f86406b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mllns5obny2w", "content": "\ud83d\udccc CVE-2026-40281 - Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for con... https://www.cyberhub.blog/cves/CVE-2026-40281", "creation_timestamp": "2026-05-11T16:07:14.301499Z"}, {"uuid": "eb4b0d95-b876-45b8-974f-50b7753e15dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://bsky.app/profile/threat-surface.bsky.social/post/3mmeygwa7nm2a", "content": "\ud83d\udd34 CVE-2026-40281: thecodingmachine gotenberg advisory\n\n\n\nhttps://www.youtube.com/shorts/K9OtI30YGD8\n\n##cybersecurity ##infosec ##cve #cybersecurity #infosec", "creation_timestamp": "2026-05-21T17:54:16.206386Z"}, {"uuid": "9e290def-5299-4f80-8bde-7698bb8e8014", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "MISP/d511a704-eba2-411a-9543-41e0e130f522", "content": "", "creation_timestamp": "2026-06-15T17:02:32.000000Z"}, {"uuid": "ed8d79d9-5c42-4404-8825-7738319e869b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://t.me/shimiscyberworld/1255", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-40281 \u2014 CVSS 10\nGotenberg PDF API Vulnerability CVE-2026-40281 Allows Arbitrary File Overwrite\n\nCVE-2026-40281 \u2014 Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characte\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-40281 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:14.100096Z"}, {"uuid": "cc9ea06b-050e-4fc4-96b1-f707c5d279a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40281", "type": "seen", "source": "https://t.me/shimiscyberworld/1255", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-40281 \u2014 CVSS 10\nGotenberg PDF API Vulnerability CVE-2026-40281 Allows Arbitrary File Overwrite\n\nCVE-2026-40281 \u2014 Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characte\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-40281 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:35.970993Z"}]}