VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-12T17:32:16Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-12 18:32:21 +01:00
1 parent 3e33de124f
commit 05e8212e38
100 files changed
+6345 -2078
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2025/10xxx/CVE-2025-10698.json
+142
View File
@@ -0,0 +1,142 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-10698",
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"state": "PUBLISHED",
"assignerShortName": "OpenText",
"dateReserved": "2025-09-18T17:13:07.250Z",
"datePublished": "2026-11-12T16:29:44.443Z",
"dateUpdated": "2026-11-12T16:29:44.443Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "OpenText",
"dateUpdated": "2026-11-12T16:29:44.443Z"
},
"title": "Improper File Permissions on Private Key Files in Docker Deployments",
"datePublic": "2025-09-01T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-1269",
"description": "CWE-1269 Product released in Non-Release configuration",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"affected": [
{
"vendor": "OpenText",
"product": "Identity Console",
"platforms": [
"Windows",
"Linux",
"64 bit"
],
"versions": [
{
"status": "affected",
"version": "1.8",
"lessThan": "25.2",
"changes": [
{
"at": "25.2",
"status": "unaffected"
}
],
"versionType": "rpm, exe"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Identity Console: from 1.8 through 25.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensitive Data.<p>This issue affects Identity Console: from 1.8 through 25.2.</p>"
}
]
}
],
"references": [
{
"url": "https://docs.microfocus.com/doc/29/25.4/securityandsoftwarefixes"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"Safety": "NEGLIGIBLE",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "CONCENTRATED",
"vulnerabilityResponseEffort": "LOW",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:U/V:C/RE:L/U:Amber"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/106xxx/CVE-2026-106154.json
+113
View File
@@ -0,0 +1,113 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-106154",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-10-06T15:51:11.738Z",
"datePublished": "2026-11-12T17:13:26.499Z",
"dateUpdated": "2026-11-12T17:13:26.499Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-12T17:13:26.499Z"
},
"title": "Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-230",
"descriptions": [
{
"lang": "en",
"value": "Serialized Data Parameter Blowup"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Telerik UI for ASP.NET Core",
"versions": [
{
"status": "affected",
"version": "2015.1.318",
"lessThanOrEqual": "2026.3.1015",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.</p>"
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
}
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/108xxx/CVE-2026-108472.json
+29 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-09T22:24:14.527Z",
"datePublished": "2026-11-11T18:38:17.370Z",
"dateUpdated": "2026-11-12T00:12:25.032Z"
"dateUpdated": "2026-11-12T16:52:56.950Z"
},
"containers": {
"cna": {
@@ -48,6 +48,25 @@
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:6.4.0-8.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
@@ -120,6 +139,14 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:99662",
"name": "RHSA-2026:99662",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-108472",
"tags": [
@@ -177,7 +204,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T18:38:17.370Z"
"dateUpdated": "2026-11-12T16:52:56.950Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112315.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:23:58.679Z",
"datePublished": "2026-11-09T19:07:47.557Z",
"dateUpdated": "2026-11-12T12:56:51.910Z"
"dateUpdated": "2026-11-12T16:47:25.081Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112315",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:56:51.910Z"
"dateUpdated": "2026-11-12T16:47:25.081Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112316.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:24:50.360Z",
"datePublished": "2026-11-09T19:08:00.263Z",
"dateUpdated": "2026-11-12T12:56:53.760Z"
"dateUpdated": "2026-11-12T16:47:29.411Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112316",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:56:53.760Z"
"dateUpdated": "2026-11-12T16:47:29.411Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112317.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:25:20.662Z",
"datePublished": "2026-11-09T19:07:58.372Z",
"dateUpdated": "2026-11-12T12:56:55.968Z"
"dateUpdated": "2026-11-12T16:47:35.522Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112317",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:56:55.968Z"
"dateUpdated": "2026-11-12T16:47:35.522Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112318.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:25:59.007Z",
"datePublished": "2026-11-09T19:08:02.661Z",
"dateUpdated": "2026-11-12T12:56:57.981Z"
"dateUpdated": "2026-11-12T16:47:39.479Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112318",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:56:57.981Z"
"dateUpdated": "2026-11-12T16:47:39.479Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112319.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:26:25.093Z",
"datePublished": "2026-11-09T19:08:05.007Z",
"dateUpdated": "2026-11-12T12:57:02.764Z"
"dateUpdated": "2026-11-12T16:47:44.222Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112319",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:57:02.764Z"
"dateUpdated": "2026-11-12T16:47:44.222Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112320.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:26:51.377Z",
"datePublished": "2026-11-09T19:08:07.434Z",
"dateUpdated": "2026-11-12T12:57:03.261Z"
"dateUpdated": "2026-11-12T16:47:49.479Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112320",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:57:03.261Z"
"dateUpdated": "2026-11-12T16:47:49.479Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112321.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:27:17.372Z",
"datePublished": "2026-11-09T19:08:10.347Z",
"dateUpdated": "2026-11-12T12:57:05.412Z"
"dateUpdated": "2026-11-12T16:47:53.597Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112321",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:57:05.412Z"
"dateUpdated": "2026-11-12T16:47:53.597Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112322.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:27:47.648Z",
"datePublished": "2026-11-09T18:43:23.841Z",
"dateUpdated": "2026-11-12T12:57:03.732Z"
"dateUpdated": "2026-11-12T16:47:57.396Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112322",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:57:03.732Z"
"dateUpdated": "2026-11-12T16:47:57.396Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112323.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:29:07.369Z",
"datePublished": "2026-11-09T18:43:29.636Z",
"dateUpdated": "2026-11-12T12:57:08.404Z"
"dateUpdated": "2026-11-12T16:48:02.393Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112323",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:57:08.404Z"
"dateUpdated": "2026-11-12T16:48:02.393Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/114xxx/CVE-2026-114031.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Illumio",
"dateReserved": "2026-10-20T21:11:53.061Z",
"datePublished": "2026-11-09T21:31:15.467Z",
"dateUpdated": "2026-11-10T19:16:07.428Z"
"dateUpdated": "2026-11-12T17:11:30.616Z"
},
"containers": {
"cna": {
@@ -225,6 +225,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:10:35.342224Z",
"id": "CVE-2026-114031",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:11:30.616Z"
}
}
]
}
}
data/2026/114xxx/CVE-2026-114032.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Illumio",
"dateReserved": "2026-10-20T21:11:53.061Z",
"datePublished": "2026-11-09T21:31:52.776Z",
"dateUpdated": "2026-11-09T21:35:32.985Z"
"dateUpdated": "2026-11-12T17:16:38.649Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:14:02.415605Z",
"id": "CVE-2026-114032",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:16:38.649Z"
}
}
]
}
}
data/2026/114xxx/CVE-2026-114594.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "SDC",
"dateReserved": "2026-10-21T19:56:10.660Z",
"datePublished": "2026-11-09T16:15:55.511Z",
"dateUpdated": "2026-11-09T16:15:55.511Z"
"dateUpdated": "2026-11-12T16:44:31.650Z"
},
"containers": {
"cna": {
@@ -124,6 +124,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:43:46.843251Z",
"id": "CVE-2026-114594",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:44:31.650Z"
}
}
]
}
}
data/2026/115xxx/CVE-2026-115336.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-10-22T10:41:52.792Z",
"datePublished": "2026-11-09T16:44:04.982Z",
"dateUpdated": "2026-11-09T16:44:04.982Z"
"dateUpdated": "2026-11-12T17:02:19.621Z"
},
"containers": {
"cna": {
@@ -123,6 +123,40 @@
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:01:46.220349Z",
"id": "CVE-2026-115336",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:02:19.621Z"
}
}
]
}
}
data/2026/115xxx/CVE-2026-115339.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-10-22T10:41:52.792Z",
"datePublished": "2026-11-09T16:46:51.328Z",
"dateUpdated": "2026-11-09T16:46:51.328Z"
"dateUpdated": "2026-11-12T17:03:31.754Z"
},
"containers": {
"cna": {
@@ -130,6 +130,40 @@
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:02:35.221415Z",
"id": "CVE-2026-115339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:03:31.754Z"
}
}
]
}
}
data/2026/115xxx/CVE-2026-115340.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-10-22T10:41:52.792Z",
"datePublished": "2026-11-09T16:47:31.408Z",
"dateUpdated": "2026-11-09T16:47:31.408Z"
"dateUpdated": "2026-11-12T16:47:58.302Z"
},
"containers": {
"cna": {
@@ -136,6 +136,40 @@
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:47:38.585254Z",
"id": "CVE-2026-115340",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:47:58.302Z"
}
}
]
}
}
data/2026/115xxx/CVE-2026-115864.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CPANSec",
"dateReserved": "2026-10-23T17:37:33.626Z",
"datePublished": "2026-11-09T21:16:28.102Z",
"dateUpdated": "2026-11-10T00:11:03.849Z"
"dateUpdated": "2026-11-12T17:08:12.238Z"
},
"containers": {
"cna": {
@@ -104,6 +104,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-10T00:11:03.849Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:07:56.467802Z",
"id": "CVE-2026-115864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:08:12.238Z"
}
}
]
}
data/2026/115xxx/CVE-2026-115934.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Hackrate",
"dateReserved": "2026-10-23T21:23:17.389Z",
"datePublished": "2026-11-09T22:57:57.368Z",
"dateUpdated": "2026-11-09T23:06:37.426Z"
"dateUpdated": "2026-11-12T17:06:16.752Z"
},
"containers": {
"cna": {
@@ -222,6 +222,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:05:57.922658Z",
"id": "CVE-2026-115934",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:06:16.752Z"
}
}
]
}
}
data/2026/117xxx/CVE-2026-117477.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "jpcert",
"dateReserved": "2026-10-27T06:16:54.712Z",
"datePublished": "2026-11-09T23:22:12.476Z",
"dateUpdated": "2026-11-12T05:44:32.062Z"
"dateUpdated": "2026-11-12T17:07:12.689Z"
},
"containers": {
"cna": {
@@ -194,6 +194,40 @@
"shortName": "jpcert",
"dateUpdated": "2026-11-12T05:44:32.062Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:06:48.863736Z",
"id": "CVE-2026-117477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:07:12.689Z"
}
}
]
}
}
data/2026/118xxx/CVE-2026-118492.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "eclipse",
"dateReserved": "2026-10-28T11:37:34.094Z",
"datePublished": "2026-11-09T15:57:23.409Z",
"dateUpdated": "2026-11-09T15:57:23.409Z"
"dateUpdated": "2026-11-12T16:26:15.625Z"
},
"containers": {
"cna": {
@@ -127,6 +127,48 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:25:53.162104Z",
"id": "CVE-2026-118492",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:26:15.625Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119079.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-29T13:10:23.375Z",
"datePublished": "2026-11-09T18:43:39.044Z",
"dateUpdated": "2026-11-12T12:57:13.364Z"
"dateUpdated": "2026-11-12T16:48:13.854Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.3-10.el10_2.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -126,6 +144,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99625",
"name": "RHSA-2026:99625",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-119079",
"tags": [
@@ -183,7 +209,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:57:13.364Z"
"dateUpdated": "2026-11-12T16:48:13.854Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/119xxx/CVE-2026-119274.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Infoblox",
"dateReserved": "2026-10-29T18:33:42.678Z",
"datePublished": "2026-11-09T13:19:41.967Z",
"dateUpdated": "2026-11-09T14:12:39.937Z"
"dateUpdated": "2026-11-12T16:19:01.521Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:18:37.808188Z",
"id": "CVE-2026-119274",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:19:01.521Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119474.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "TR-CERT",
"dateReserved": "2026-10-30T08:49:23.814Z",
"datePublished": "2026-11-09T14:19:45.883Z",
"dateUpdated": "2026-11-09T14:19:45.883Z"
"dateUpdated": "2026-11-12T16:20:59.367Z"
},
"containers": {
"cna": {
@@ -120,6 +120,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:20:41.102726Z",
"id": "CVE-2026-119474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:20:59.367Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120627.json
+11 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-02T17:31:22.160Z",
"datePublished": "2026-11-02T17:32:34.968Z",
"dateUpdated": "2026-11-11T20:18:59.139Z"
"dateUpdated": "2026-11-12T16:47:47.072Z"
},
"containers": {
"cna": {
@@ -20,7 +20,7 @@
}
],
"source": {
"discovery": "Souparna Majumder"
"discovery": "UNKNOWN"
},
"affected": [
{
@@ -54,15 +54,22 @@
"url": "https://github.com/Rexyysilent/PI-ay-ay-disclosure"
}
],
"credits": [
{
"lang": "en",
"value": "Souparna Majumder",
"type": "finder"
}
],
"x_generator": {
"engine": "VINCE 4.0.2",
"engine": "VINCE 4.0.3",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-120627"
},
"providerMetadata": {
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc",
"dateUpdated": "2026-11-11T20:18:59.139Z"
"dateUpdated": "2026-11-12T16:47:47.072Z"
}
},
"adp": [
data/2026/121xxx/CVE-2026-121685.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-03T19:36:53.606Z",
"datePublished": "2026-11-09T16:23:05.993Z",
"dateUpdated": "2026-11-09T16:23:05.993Z"
"dateUpdated": "2026-11-12T16:48:55.047Z"
},
"containers": {
"cna": {
@@ -65,6 +65,68 @@
"shortName": "certcc",
"dateUpdated": "2026-11-09T16:23:05.993Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-798",
"lang": "en",
"description": "CWE-798 Use of Hard-coded Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:48:49.678686Z",
"id": "CVE-2026-121685",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:48:55.047Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121686.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-03T19:37:04.418Z",
"datePublished": "2026-11-09T16:24:04.920Z",
"dateUpdated": "2026-11-09T16:24:04.920Z"
"dateUpdated": "2026-11-12T16:50:18.235Z"
},
"containers": {
"cna": {
@@ -65,6 +65,68 @@
"shortName": "certcc",
"dateUpdated": "2026-11-09T16:24:04.920Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-78",
"lang": "en",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:50:09.162760Z",
"id": "CVE-2026-121686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:50:18.235Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121687.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-03T19:37:12.923Z",
"datePublished": "2026-11-09T16:25:00.570Z",
"dateUpdated": "2026-11-09T16:25:00.570Z"
"dateUpdated": "2026-11-12T16:53:40.336Z"
},
"containers": {
"cna": {
@@ -65,6 +65,68 @@
"shortName": "certcc",
"dateUpdated": "2026-11-09T16:25:00.570Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-306",
"lang": "en",
"description": "CWE-306 Missing Authentication for Critical Function"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:53:15.574843Z",
"id": "CVE-2026-121687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:53:40.336Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121688.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-03T19:37:24.066Z",
"datePublished": "2026-11-09T16:25:50.773Z",
"dateUpdated": "2026-11-09T16:25:50.773Z"
"dateUpdated": "2026-11-12T16:55:03.614Z"
},
"containers": {
"cna": {
@@ -65,6 +65,68 @@
"shortName": "certcc",
"dateUpdated": "2026-11-09T16:25:50.773Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-494",
"lang": "en",
"description": "CWE-494 Download of Code Without Integrity Check"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:54:54.914760Z",
"id": "CVE-2026-121688",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:55:03.614Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121689.json
+52 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-03T19:37:38.749Z",
"datePublished": "2026-11-09T16:27:03.106Z",
"dateUpdated": "2026-11-09T16:27:03.106Z"
"dateUpdated": "2026-11-12T16:56:37.142Z"
},
"containers": {
"cna": {
@@ -65,6 +65,56 @@
"shortName": "certcc",
"dateUpdated": "2026-11-09T16:27:03.106Z"
}
}
},
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:55:55.437322Z",
"id": "CVE-2026-121689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:56:37.142Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121690.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-03T19:37:50.573Z",
"datePublished": "2026-11-09T16:31:12.883Z",
"dateUpdated": "2026-11-09T16:31:12.883Z"
"dateUpdated": "2026-11-12T17:00:05.885Z"
},
"containers": {
"cna": {
@@ -65,6 +65,68 @@
"shortName": "certcc",
"dateUpdated": "2026-11-09T16:31:12.883Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-250",
"lang": "en",
"description": "CWE-250 Execution with Unnecessary Privileges"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.7,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:59:55.095222Z",
"id": "CVE-2026-121690",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:00:05.885Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121841.json
+63 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mozilla",
"dateReserved": "2026-11-04T07:47:08.439Z",
"datePublished": "2026-11-09T13:42:32.619Z",
"dateUpdated": "2026-11-09T13:42:32.619Z"
"dateUpdated": "2026-11-12T16:26:22.329Z"
},
"containers": {
"cna": {
@@ -59,6 +59,67 @@
"shortName": "mozilla",
"dateUpdated": "2026-11-09T13:42:32.619Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"lang": "en",
"description": "CWE-noinfo Not enough information"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.3,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:26:17.170739Z",
"id": "CVE-2026-121841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:26:22.329Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121876.json
+227
View File
@@ -0,0 +1,227 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-121876",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-04T10:34:49.034Z",
"datePublished": "2026-11-12T16:55:35.424Z",
"dateUpdated": "2026-11-12T16:55:35.424Z"
},
"containers": {
"cna": {
"title": "Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the interaction between systemd-gpt-auto-generator and \nconfidential computing guest VM images in OpenShift Sandboxed Containers \n(confidential peer pods). systemd-gpt-auto-generator automatically discovers \nand mounts GPT partitions by type GUID at boot with no user confirmation. In \nthe confidential computing threat model, where the host/hypervisor is the \nadversary, a malicious host can inject partitions into the guest's virtual \ndisk. Most critically, injecting a swap partition causes the guest kernel to \npage out TEE-encrypted memory to a host-controlled block device, breaking the \nconfidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX).\n\nThe PodVM images use a GPT-partitioned disk with dm-verity on the root \npartition. However, the roothash= kernel parameter only disables root \nauto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are \nstill auto-discovered and mounted. The generator is shipped unmasked in the \nRHEL systemd-udev subpackage, and no kernel command line parameter in the \nmeasured UKI addon disables it. Additionally, the PodVM measurement script \ncaptures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so \npartition table modifications are not detected by remote attestation."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel-rt",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel-rt",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel-rt",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 5",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:5"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-121876",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558210",
"name": "RHBZ#2558210",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-12T14:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-359",
"description": "Exposure of Private Personal Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor",
"workarounds": [
{
"lang": "en",
"value": "Add systemd.gpt_auto=0 to the measured kernel command line (UKI addon) to completely \ndisable systemd-gpt-auto-generator. Since the PodVM already uses explicit partition \nlayout and dm-verity, auto-discovery is unnecessary.\n\nAlternative mitigations:\n- Disable swap specifically: add systemd.swap=0 to the kernel command line\n- Mask the generator in the guest image: \n ln -sf /dev/null /etc/systemd/system-generators/systemd-gpt-auto-generator\n- Include PCR 5 in the PodVM measurement script alongside PCRs 3, 9, 11, 12\n- For systemd 254+: set restrictive image policy via systemd.image_policy=root=verity+signed+encrypted+unprotected+absent:swap=absent:home=absent:srv=absent:var=absent:tmp=absent"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-16T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-12T14:00:00.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Spyros Seimenis (Edgeless Systems) for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:55:35.424Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/123xxx/CVE-2026-123753.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-11-06T13:16:11.385Z",
"datePublished": "2026-11-09T10:28:48.990Z",
"dateUpdated": "2026-11-09T11:08:56.098Z"
"dateUpdated": "2026-11-12T16:22:22.516Z"
},
"containers": {
"cna": {
@@ -130,6 +130,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T11:08:56.098Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:22:17.477533Z",
"id": "CVE-2026-123753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:22:22.516Z"
}
}
]
}
data/2026/123xxx/CVE-2026-123779.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-11-06T14:27:45.371Z",
"datePublished": "2026-11-09T10:29:30.229Z",
"dateUpdated": "2026-11-09T11:09:03.661Z"
"dateUpdated": "2026-11-12T16:25:02.402Z"
},
"containers": {
"cna": {
@@ -146,6 +146,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T11:09:03.661Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:24:55.842592Z",
"id": "CVE-2026-123779",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:25:02.402Z"
}
}
]
}
data/2026/123xxx/CVE-2026-123790.json
+17 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-06T14:47:00.908Z",
"datePublished": "2026-11-12T14:48:30.110Z",
"dateUpdated": "2026-11-12T15:13:46.135Z"
"dateUpdated": "2026-11-12T17:05:16.327Z"
},
"containers": {
"cna": {
@@ -67,6 +67,21 @@
"shortName": "certcc",
"dateUpdated": "2026-11-12T15:13:46.135Z"
}
}
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/944667"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-11-12T17:05:16.327Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124018.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.544Z",
"datePublished": "2026-11-12T13:35:12.175Z",
"dateUpdated": "2026-11-12T13:35:12.175Z"
"dateUpdated": "2026-11-12T17:17:47.526Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:38:20.354317Z",
"id": "CVE-2026-124018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:17:47.526Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124033.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "AMZN",
"dateReserved": "2026-11-06T18:55:25.625Z",
"datePublished": "2026-11-09T21:05:06.845Z",
"dateUpdated": "2026-11-09T21:10:01.049Z"
"dateUpdated": "2026-11-12T17:01:07.789Z"
},
"containers": {
"cna": {
@@ -173,6 +173,40 @@
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:00:43.978105Z",
"id": "CVE-2026-124033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:01:07.789Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124034.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "AMZN",
"dateReserved": "2026-11-06T18:55:26.095Z",
"datePublished": "2026-11-09T22:27:36.976Z",
"dateUpdated": "2026-11-09T22:32:51.158Z"
"dateUpdated": "2026-11-12T17:02:13.268Z"
},
"containers": {
"cna": {
@@ -180,6 +180,40 @@
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:01:54.698784Z",
"id": "CVE-2026-124034",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:02:13.268Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124035.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "AMZN",
"dateReserved": "2026-11-06T18:55:26.778Z",
"datePublished": "2026-11-09T22:28:39.044Z",
"dateUpdated": "2026-11-09T22:34:22.012Z"
"dateUpdated": "2026-11-12T17:03:05.901Z"
},
"containers": {
"cna": {
@@ -180,6 +180,40 @@
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:02:46.138932Z",
"id": "CVE-2026-124035",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:03:05.901Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124249.json
+33 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PSF",
"dateReserved": "2026-11-07T00:18:32.381Z",
"datePublished": "2026-11-09T14:20:47.891Z",
"dateUpdated": "2026-11-11T00:25:56.116Z"
"dateUpdated": "2026-11-12T16:23:47.134Z"
},
"containers": {
"cna": {
@@ -172,6 +172,38 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T21:04:57.164Z"
}
},
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:23:30.385286Z",
"id": "CVE-2026-124249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:23:47.134Z"
}
}
]
}
data/2026/124xxx/CVE-2026-124598.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GV",
"dateReserved": "2026-11-09T01:42:46.616Z",
"datePublished": "2026-11-10T00:18:17.969Z",
"dateUpdated": "2026-11-10T00:18:17.969Z"
"dateUpdated": "2026-11-12T17:08:39.602Z"
},
"containers": {
"cna": {
@@ -137,6 +137,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:08:18.909919Z",
"id": "CVE-2026-124598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:08:39.602Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124691.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124691",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-11-09T10:41:42.890Z",
"datePublished": "2026-11-12T16:42:30.326Z",
"dateUpdated": "2026-11-12T16:47:05.093Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-12T16:47:05.093Z"
},
"title": "Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Scripting (XSS)"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Kendo UI for jQuery",
"versions": [
{
"status": "affected",
"version": "2020.3.915",
"lessThanOrEqual": "2026.3.1015",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.</p>"
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-gantt-parent-dropdown-xss-cve-2026-124691",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
}
],
"credits": [
{
"lang": "en",
"value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/124xxx/CVE-2026-124695.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124695",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-11-09T10:41:42.890Z",
"datePublished": "2026-11-12T16:52:14.648Z",
"dateUpdated": "2026-11-12T16:52:14.648Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-12T16:52:14.648Z"
},
"title": "Cross-Site Scripting in Kendo UI for jQuery Form Item Hints",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Scripting (XSS)"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Kendo UI for jQuery",
"versions": [
{
"status": "affected",
"version": "2020.2.513",
"lessThanOrEqual": "2026.3.1015",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.</p>"
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-form-item-hint-xss-cve-2026-124695",
"tags": [
"vendor-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
}
]
}
}
}
data/2026/124xxx/CVE-2026-124696.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124696",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-11-09T10:41:43.932Z",
"datePublished": "2026-11-12T17:02:11.806Z",
"dateUpdated": "2026-11-12T17:02:11.806Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-12T17:02:11.806Z"
},
"title": "Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Scripting (XSS)"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Kendo UI for jQuery",
"versions": [
{
"status": "affected",
"version": "2024.4.1112",
"lessThanOrEqual": "2026.3.1015",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.</p>"
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-spreadsheet-sheet-names-xss-cve-2026-124696",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
}
],
"credits": [
{
"lang": "en",
"value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/124xxx/CVE-2026-124697.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124697",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-11-09T10:41:43.933Z",
"datePublished": "2026-11-12T17:06:27.602Z",
"dateUpdated": "2026-11-12T17:06:27.602Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-12T17:06:27.602Z"
},
"title": "Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Scripting (XSS)"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Kendo UI for jQuery",
"versions": [
{
"status": "affected",
"version": "2016.2.607",
"lessThanOrEqual": "2026.3.1015",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.</p>"
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-shared-tooltip-xss-cve-2026-124697",
"tags": [
"vendor-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
}
]
}
}
}
data/2026/124xxx/CVE-2026-124698.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124698",
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"state": "PUBLISHED",
"assignerShortName": "ProgressSoftware",
"dateReserved": "2026-11-09T10:41:43.933Z",
"datePublished": "2026-11-12T17:09:34.698Z",
"dateUpdated": "2026-11-12T17:09:34.698Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware",
"dateUpdated": "2026-11-12T17:09:34.698Z"
},
"title": "Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Scripting (XSS)"
}
]
}
],
"affected": [
{
"vendor": "Progress Software",
"product": "Kendo UI for jQuery",
"versions": [
{
"status": "affected",
"version": "2016.2.607",
"lessThanOrEqual": "2026.3.1015",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.</p>"
}
]
}
],
"references": [
{
"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-tooltip-point-value-xss-cve-2026-124698",
"tags": [
"vendor-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
}
]
}
}
}
data/2026/124xxx/CVE-2026-124850.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CIRCL",
"dateReserved": "2026-11-09T14:38:45.169Z",
"datePublished": "2026-11-09T14:43:27.959Z",
"dateUpdated": "2026-11-09T14:43:27.959Z"
"dateUpdated": "2026-11-12T16:24:54.028Z"
},
"containers": {
"cna": {
@@ -320,6 +320,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:24:26.530803Z",
"id": "CVE-2026-124850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:24:54.028Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124959.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-09T15:02:37.082Z",
"datePublished": "2026-11-09T15:04:38.649Z",
"dateUpdated": "2026-11-09T15:04:38.649Z"
"dateUpdated": "2026-11-12T16:41:04.273Z"
},
"containers": {
"cna": {
@@ -79,6 +79,68 @@
"shortName": "certcc",
"dateUpdated": "2026-11-09T15:04:38.649Z"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-787",
"lang": "en",
"description": "CWE-787 Out-of-bounds Write"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.1,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:40:51.440851Z",
"id": "CVE-2026-124959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:41:04.273Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126189.json
+112
View File
@@ -0,0 +1,112 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126189",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T20:07:44.957Z",
"datePublished": "2026-11-12T16:53:00.822Z",
"dateUpdated": "2026-11-12T16:53:00.822Z"
},
"containers": {
"cna": {
"title": "Soup Sieve: Quadratic-time denial of service when matching `:has()`",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"lang": "en",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-8jvp-3x96-xpqw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-8jvp-3x96-xpqw"
},
{
"name": "https://github.com/facelessuser/soupsieve/pull/352",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/pull/352"
},
{
"name": "https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379"
},
{
"name": "https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44"
},
{
"name": "https://github.com/facelessuser/soupsieve/releases/tag/4.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/releases/tag/4.0.1"
}
],
"affected": [
{
"vendor": "facelessuser",
"product": "soupsieve",
"versions": [
{
"version": "< 4.0.1",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T16:53:00.822Z"
},
"descriptions": [
{
"lang": "en",
"value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1."
}
],
"source": {
"advisory": "GHSA-8jvp-3x96-xpqw",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126190.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126190",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T20:07:44.957Z",
"datePublished": "2026-11-12T16:54:14.644Z",
"dateUpdated": "2026-11-12T16:54:14.644Z"
},
"containers": {
"cna": {
"title": "Soup Sieve: Polynomial-time denial of service in the descendant combinator",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"lang": "en",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f"
},
{
"name": "https://github.com/facelessuser/soupsieve/pull/351",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/pull/351"
},
{
"name": "https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320"
},
{
"name": "https://github.com/facelessuser/soupsieve/releases/tag/4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/releases/tag/4.0"
}
],
"affected": [
{
"vendor": "facelessuser",
"product": "soupsieve",
"versions": [
{
"version": "< 4.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T16:54:14.644Z"
},
"descriptions": [
{
"lang": "en",
"value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0."
}
],
"source": {
"advisory": "GHSA-mmhr-3c5m-f64f",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126191.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126191",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T20:07:44.957Z",
"datePublished": "2026-11-12T16:57:01.566Z",
"dateUpdated": "2026-11-12T16:57:01.566Z"
},
"containers": {
"cna": {
"title": "Soup Sieve: Exponential ReDoS in selector compilation via \\9-run in CSS_ESCAPES/IDENTIFIER",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"lang": "en",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x"
},
{
"name": "https://github.com/facelessuser/soupsieve/pull/300",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/pull/300"
},
{
"name": "https://github.com/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e"
},
{
"name": "https://github.com/facelessuser/soupsieve/releases/tag/3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/releases/tag/3.0"
}
],
"affected": [
{
"vendor": "facelessuser",
"product": "soupsieve",
"versions": [
{
"version": "< 3.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T16:57:01.566Z"
},
"descriptions": [
{
"lang": "en",
"value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failure occurs during selector compilation through soupsieve.compile() or Beautiful Soup select() before SELECTOR_LIMIT is applied, so an application that accepts untrusted selector strings can have a worker stalled by a short input. This issue is fixed in version 3.0."
}
],
"source": {
"advisory": "GHSA-6655-6qjp-jx7x",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126192.json
+118
View File
@@ -0,0 +1,118 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126192",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T20:07:44.957Z",
"datePublished": "2026-11-12T17:09:14.205Z",
"dateUpdated": "2026-11-12T17:09:14.205Z"
},
"containers": {
"cna": {
"title": "Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"lang": "en",
"description": "CWE-400: Uncontrolled Resource Consumption",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"lang": "en",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4"
},
{
"name": "https://github.com/facelessuser/soupsieve/pull/304",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/pull/304"
},
{
"name": "https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0"
},
{
"name": "https://github.com/facelessuser/soupsieve/releases/tag/2.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/releases/tag/2.10"
}
],
"affected": [
{
"vendor": "facelessuser",
"product": "soupsieve",
"versions": [
{
"version": "< 2.10",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T17:09:14.205Z"
},
"descriptions": [
{
"lang": "en",
"value": "Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10."
}
],
"source": {
"advisory": "GHSA-4j63-6c4x-wfg4",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126193.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126193",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T20:07:44.957Z",
"datePublished": "2026-11-12T17:12:02.083Z",
"dateUpdated": "2026-11-12T17:12:02.083Z"
},
"containers": {
"cna": {
"title": "Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"lang": "en",
"description": "CWE-674: Uncontrolled Recursion",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-7g44-g9rc-x53w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/facelessuser/soupsieve/security/advisories/GHSA-7g44-g9rc-x53w"
},
{
"name": "https://github.com/facelessuser/soupsieve/pull/306",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/pull/306"
},
{
"name": "https://github.com/facelessuser/soupsieve/commit/52de12f157a373614ad0f486d434551c5a4378ee",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/commit/52de12f157a373614ad0f486d434551c5a4378ee"
},
{
"name": "https://github.com/facelessuser/soupsieve/releases/tag/3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facelessuser/soupsieve/releases/tag/3.0"
}
],
"affected": [
{
"vendor": "facelessuser",
"product": "soupsieve",
"versions": [
{
"version": ">= 0.4, < 3.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T17:12:02.083Z"
},
"descriptions": [
{
"lang": "en",
"value": "Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise  RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0."
}
],
"source": {
"advisory": "GHSA-7g44-g9rc-x53w",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126835.json
+132
View File
@@ -0,0 +1,132 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126835",
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"state": "PUBLISHED",
"assignerShortName": "mongodb",
"dateReserved": "2026-11-11T21:29:16.291Z",
"datePublished": "2026-11-12T17:06:05.064Z",
"dateUpdated": "2026-11-12T17:06:05.064Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb",
"dateUpdated": "2026-11-12T17:06:05.064Z"
},
"title": "[Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-923",
"description": "CWE-923: Improper Restriction of Communication Channel to Intended Endpoints",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "MongoDB",
"product": "Node.js Driver",
"versions": [
{
"status": "affected",
"version": ">= 6.7.0",
"lessThan": "7.9.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver."
}
]
}
],
"references": [
{
"url": "https://github.com/mongodb/node-mongodb-native/releases/tag/v7.9.0"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/126xxx/CVE-2026-126837.json
+132
View File
@@ -0,0 +1,132 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126837",
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"state": "PUBLISHED",
"assignerShortName": "mongodb",
"dateReserved": "2026-11-11T21:48:08.923Z",
"datePublished": "2026-11-12T17:00:11.830Z",
"dateUpdated": "2026-11-12T17:00:11.830Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb",
"dateUpdated": "2026-11-12T17:00:11.830Z"
},
"title": "Attacker able to redirect a client's database traffic to a host they control via special characters in an SRV target, bypassing the SRV parent-domain guard",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "MongoDB",
"product": "Node.js Driver",
"versions": [
{
"status": "affected",
"version": "3.3.3",
"lessThan": "7.8.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The driver then builds the connection address from the original name, in which certain characters end the host name early. An unauthenticated party who can forge or change the DNS SRV response may redirect the connection to a host of their choice. TLS does not prevent this, because the driver verifies the server certificate against the redirected host name. This may result in unintended disclosure of application data and authentication credentials, and in altered query results. Applications that use mongodb:// connection strings are not affected.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The driver then builds the connection address from the original name, in which certain characters end the host name early. An unauthenticated party who can forge or change the DNS SRV response may redirect the connection to a host of their choice. TLS does not prevent this, because the driver verifies the server certificate against the redirected host name. This may result in unintended disclosure of application data and authentication credentials, and in altered query results. Applications that use mongodb:// connection strings are not affected."
}
]
}
],
"references": [
{
"url": "https://jira.mongodb.org/browse/NODE-7830"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "CRITICAL",
"baseScore": 9.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/126xxx/CVE-2026-126994.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-12T07:57:21.265Z",
"datePublished": "2026-11-12T12:30:27.079Z",
"dateUpdated": "2026-11-12T12:30:27.079Z"
"dateUpdated": "2026-11-12T17:17:55.217Z"
},
"containers": {
"cna": {
@@ -194,6 +194,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:57:29.399155Z",
"id": "CVE-2026-126994",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:17:55.217Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126998.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-12T08:04:31.383Z",
"datePublished": "2026-11-12T14:45:16.200Z",
"dateUpdated": "2026-11-12T14:45:16.200Z"
"dateUpdated": "2026-11-12T17:17:39.139Z"
},
"containers": {
"cna": {
@@ -177,6 +177,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:57:32.059850Z",
"id": "CVE-2026-126998",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:17:39.139Z"
}
}
]
}
}
data/2026/127xxx/CVE-2026-127029.json
+173
View File
@@ -0,0 +1,173 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127029",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-12T10:45:33.541Z",
"datePublished": "2026-11-12T16:21:48.973Z",
"dateUpdated": "2026-11-12T16:21:48.973Z"
},
"containers": {
"cna": {
"title": "Freeradius: stack-based buffer overflow via unbounded eap-sim identity length",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS)."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "unknown",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius:3.0/freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-127029",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572339",
"name": "RHBZ#2572339",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
},
{
"url": "https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"
},
{
"url": "https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572"
}
],
"datePublic": "2026-11-12T12:10:20.004Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-787: Out-of-bounds Write",
"workarounds": [
{
"lang": "en",
"value": "Disable the EAP-SIM submodule in the FreeRADIUS configuration if SIM-based authentication is not required:\n\n1. Edit `/etc/raddb/mods-available/eap` (or `/etc/raddb/mods-enabled/eap`) and comment out or remove the `sim` configuration block within the `eap` module definition:\n\n```\n# sim {\n# }\n```\n\n2. Restart the FreeRADIUS service to apply the changes:\n\n```\nsystemctl restart radiusd\n```\n\nWarning: Restarting or reloading the FreeRADIUS service will temporarily interrupt active RADIUS authentication requests. Clients relying on EAP-SIM authentication will no longer be able to authenticate.\n\nAdditionally, restrict RADIUS UDP traffic (ports 1812 and 1813) to trusted Network Access Server (NAS) IP addresses using firewall rules to limit exposure to untrusted networks."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T10:16:22.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-12T12:10:20.004Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank s4cr00t (Alipay Security Team) for reporting this issue. Upstream acknowledges Glen Saunders as the original reporter."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:21:48.973Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/127xxx/CVE-2026-127030.json
+173
View File
@@ -0,0 +1,173 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127030",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-12T10:45:33.541Z",
"datePublished": "2026-11-12T16:21:52.568Z",
"dateUpdated": "2026-11-12T16:21:52.568Z"
},
"containers": {
"cna": {
"title": "Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS)."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius:3.0/freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "freeradius",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-127030",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572340",
"name": "RHBZ#2572340",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
},
{
"url": "https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"
},
{
"url": "https://github.com/FreeRADIUS/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef"
}
],
"datePublic": "2026-11-12T12:12:02.163Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-787: Out-of-bounds Write",
"workarounds": [
{
"lang": "en",
"value": "Disable the EAP-FAST submodule in the FreeRADIUS configuration, or restrict incoming RADIUS traffic to trusted network access points.\n\n1. Disable EAP-FAST:\nIn `/etc/raddb/mods-available/eap` (or `/etc/raddb/eap.conf`), comment out the `fast` section within the `eap` configuration block and verify that `default_eap_type` is not set to `fast`.\n\n2. Apply configuration changes:\n```\nsystemctl restart radiusd\n```\n\n3. Limit network exposure:\nRestrict UDP port 1812 to authorized Network Access Server (NAS) clients using firewalld:\n```\nfirewall-cmd --permanent --zone=internal --add-source=<TRUSTED_IP_OR_SUBNET>\nfirewall-cmd --permanent --zone=internal --add-port=1812/udp\nfirewall-cmd --reload\n```\n\nCaveats:\nDisabling EAP-FAST prevents authentication for any network clients that rely exclusively on EAP-FAST. Restricting firewall rules will block traffic from unlisted authenticator sources.\n\nWarning:\nRestarting or reloading the radiusd service will temporarily disrupt active RADIUS authentication processing."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T10:16:22.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-12T12:12:02.163Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank s4cr00t (Alipay Security Team) for reporting this issue. Upstream acknowledges Ada Logics and TristanInSec@gmail.com as the original reporters."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:21:52.568Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/127xxx/CVE-2026-127109.json
+17 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-12T15:07:38.409Z",
"datePublished": "2026-11-12T15:08:53.202Z",
"dateUpdated": "2026-11-12T15:08:53.202Z"
"dateUpdated": "2026-11-12T17:05:17.829Z"
},
"containers": {
"cna": {
@@ -61,6 +61,21 @@
"shortName": "certcc",
"dateUpdated": "2026-11-12T15:08:53.202Z"
}
}
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/685399"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-11-12T17:05:17.829Z"
}
}
]
}
}
data/2026/127xxx/CVE-2026-127121.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T15:30:07.716Z",
"datePublished": "2026-11-12T15:55:12.349Z",
"dateUpdated": "2026-11-12T15:55:12.349Z"
"dateUpdated": "2026-11-12T17:17:31.603Z"
},
"containers": {
"cna": {
@@ -142,6 +142,40 @@
"x_generator": {
"engine": "vulncheck"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:38:22.620203Z",
"id": "CVE-2026-127121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:17:31.603Z"
}
}
]
}
}
data/2026/127xxx/CVE-2026-127141.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T15:47:15.872Z",
"datePublished": "2026-11-12T15:59:58.626Z",
"dateUpdated": "2026-11-12T15:59:58.626Z"
"dateUpdated": "2026-11-12T17:17:20.710Z"
},
"containers": {
"cna": {
@@ -142,6 +142,40 @@
"x_generator": {
"engine": "vulncheck"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:27:39.777993Z",
"id": "CVE-2026-127141",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:17:20.710Z"
}
}
]
}
}
data/2026/127xxx/CVE-2026-127202.json
+162
View File
@@ -0,0 +1,162 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127202",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T16:30:10.902Z",
"datePublished": "2026-11-12T16:37:02.081Z",
"dateUpdated": "2026-11-12T16:37:02.081Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T16:37:02.081Z"
},
"title": "MLflow < 3.18.0 Path Traversal via model_id in log_outputs API",
"descriptions": [
{
"lang": "en",
"value": "MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attackers can exploit the unvalidated model_id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE."
}
],
"tags": [
"x_open-source"
],
"datePublic": "2026-10-26T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "mlflow",
"product": "mlflow",
"packageURL": "pkg:pypi/mlflow",
"repo": "https://github.com/mlflow/mlflow",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThan": "3.18.0"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"version": "3.1",
"baseSeverity": "MEDIUM",
"baseScore": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
}
],
"references": [
{
"url": "https://github.com/mlflow/mlflow/releases/tag/v3.18.0",
"name": "Release Notes",
"tags": [
"release-notes"
]
},
{
"url": "https://github.com/mlflow/mlflow/pull/27131",
"name": "Pull Request",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/mlflow/mlflow/commit/ab5fc795eedc22348253cf687818cf2a16c15282",
"name": "Patch Commit",
"tags": [
"patch",
"issue-tracking"
]
},
{
"url": "https://www.vulncheck.com/advisories/mlflow-path-traversal-via-model-id-in-log-outputs-api",
"name": "VulnCheck Advisory: MLflow < 3.18.0 Path Traversal via model_id in log_outputs API",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "Florian Kabashi",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2026/127xxx/CVE-2026-127203.json
+148
View File
@@ -0,0 +1,148 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127203",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T16:30:10.902Z",
"datePublished": "2026-11-12T16:42:40.069Z",
"dateUpdated": "2026-11-12T16:42:40.069Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T16:42:40.069Z"
},
"title": "AppFlowy Cloud 0.9.64 Stored XSS via Blob Upload Content-Type",
"descriptions": [
{
"lang": "en",
"value": "AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition header or authentication on the retrieval route. Attackers can upload a text/html or image/svg+xml blob via put_blob_handler, which is then rendered as an active same-origin document through the unauthenticated get_blob_handler endpoint and cached immutably for one year, enabling persistent script execution against any visitor who accesses the URL."
}
],
"tags": [
"x_open-source",
"unsupported-when-assigned"
],
"datePublic": "2026-11-09T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "AppFlowy-IO",
"product": "AppFlowy-Cloud",
"packageURL": "pkg:github/AppFlowy-IO/AppFlowy-Cloud",
"repo": "https://github.com/AppFlowy-IO/AppFlowy-Cloud",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "0.9.64"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"version": "3.1",
"baseSeverity": "MEDIUM",
"baseScore": 5.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
}
],
"references": [
{
"url": "https://gist.github.com/mtholmquist/9b9683104fc3b5d78a488c06a6674e5c",
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
]
},
{
"url": "https://www.vulncheck.com/advisories/appflowy-cloud-stored-xss-via-blob-upload-content-type",
"name": "VulnCheck Advisory: AppFlowy Cloud 0.9.64 Stored XSS via Blob Upload Content-Type",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "Michael Holmquist (@mtholmquist), Hasp Labs.",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2026/13xxx/CVE-2026-13409.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Axis",
"dateReserved": "2026-06-26T09:31:55.373Z",
"datePublished": "2026-11-10T05:15:29.566Z",
"dateUpdated": "2026-11-10T05:15:29.566Z"
"dateUpdated": "2026-11-12T17:10:18.024Z"
},
"containers": {
"cna": {
@@ -121,6 +121,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:10:04.582284Z",
"id": "CVE-2026-13409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:10:18.024Z"
}
}
]
}
}
data/2026/14xxx/CVE-2026-14542.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Axis",
"dateReserved": "2026-07-03T06:01:00.873Z",
"datePublished": "2026-11-10T05:17:45.674Z",
"dateUpdated": "2026-11-10T05:17:45.674Z"
"dateUpdated": "2026-11-12T17:11:16.083Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:10:58.568541Z",
"id": "CVE-2026-14542",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:11:16.083Z"
}
}
]
}
}
data/2026/14xxx/CVE-2026-14543.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Axis",
"dateReserved": "2026-07-03T06:01:02.000Z",
"datePublished": "2026-11-10T05:20:29.154Z",
"dateUpdated": "2026-11-10T05:20:29.154Z"
"dateUpdated": "2026-11-12T17:11:50.904Z"
},
"containers": {
"cna": {
@@ -113,6 +113,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:11:36.936658Z",
"id": "CVE-2026-14543",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:11:50.904Z"
}
}
]
}
}
data/2026/16xxx/CVE-2026-16052.json
+148
View File
@@ -0,0 +1,148 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-16052",
"assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
"state": "PUBLISHED",
"assignerShortName": "PSF",
"dateReserved": "2026-07-17T10:34:29.475Z",
"datePublished": "2026-11-12T16:28:03.251Z",
"dateUpdated": "2026-11-12T16:28:03.251Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"http",
"http.cookies"
],
"product": "CPython",
"repo": "https://github.com/python/cpython",
"vendor": "Python Software Foundation",
"versions": [
{
"lessThan": "3.16.0",
"status": "affected",
"version": "0",
"versionType": "python"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Qi Deng (https://github.com/ikow)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Stan Ulbrych (https://github.com/StanFromIreland)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Brett Smith (https://github.com/brettcs)"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Seth Larson (https://github.com/sethmlarson)"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Victor Stinner (https://github.com/vstinner)"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Senthil Kumaran (https://github.com/orsenthil)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"value": "The http.cookies.Morsel class allows separator semicolons in attribute\nvalues\nand includes them verbatim in all output formats. An attacker who can\ncontrol\nthese values could use this to relax the cookie's Domain or SameSite\nrestrictions."
}
],
"value": "The http.cookies.Morsel class allows separator semicolons in attribute\nvalues\nand includes them verbatim in all output formats. An attacker who can\ncontrol\nthese values could use this to relax the cookie's Domain or SameSite\nrestrictions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
"shortName": "PSF",
"dateUpdated": "2026-11-12T16:28:03.251Z"
},
"references": [
{
"url": "https://github.com/python/cpython/pull/161711"
},
{
"url": "https://github.com/python/cpython/issues/161707"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IZL4QUFV7PKGT2JYSU2DCBMLTWYJDGKZ/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel"
}
}
}
data/2026/16xxx/CVE-2026-16283.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "TR-CERT",
"dateReserved": "2026-07-20T11:05:16.378Z",
"datePublished": "2026-11-09T13:29:16.473Z",
"dateUpdated": "2026-11-09T13:29:16.473Z"
"dateUpdated": "2026-11-12T16:19:43.611Z"
},
"containers": {
"cna": {
@@ -120,6 +120,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:19:28.942488Z",
"id": "CVE-2026-16283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:19:43.611Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17278.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-24T23:57:42.335Z",
"datePublished": "2026-11-07T04:32:29.843Z",
"dateUpdated": "2026-11-07T04:32:29.843Z"
"dateUpdated": "2026-11-12T16:38:45.331Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:38:37.098471Z",
"id": "CVE-2026-17278",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:38:45.331Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17309.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T01:22:23.445Z",
"datePublished": "2026-11-07T04:33:01.109Z",
"dateUpdated": "2026-11-07T04:33:01.109Z"
"dateUpdated": "2026-11-12T16:35:47.324Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:35:38.339614Z",
"id": "CVE-2026-17309",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:35:47.324Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17315.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T01:37:55.839Z",
"datePublished": "2026-11-07T04:33:07.476Z",
"dateUpdated": "2026-11-07T04:33:07.476Z"
"dateUpdated": "2026-11-12T16:32:48.187Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:32:40.446987Z",
"id": "CVE-2026-17315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:32:48.187Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17329.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T02:14:21.963Z",
"datePublished": "2026-11-07T04:33:21.858Z",
"dateUpdated": "2026-11-07T04:33:21.858Z"
"dateUpdated": "2026-11-12T16:34:01.332Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:33:52.140284Z",
"id": "CVE-2026-17329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:34:01.332Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17360.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T03:14:45.452Z",
"datePublished": "2026-11-07T04:33:47.951Z",
"dateUpdated": "2026-11-07T04:33:47.951Z"
"dateUpdated": "2026-11-12T16:39:54.676Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:39:45.786906Z",
"id": "CVE-2026-17360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:39:54.676Z"
}
}
]
}
}
data/2026/18xxx/CVE-2026-18838.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-08-04T14:38:56.132Z",
"datePublished": "2026-11-07T04:34:40.256Z",
"dateUpdated": "2026-11-07T04:34:40.256Z"
"dateUpdated": "2026-11-12T16:37:22.259Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:37:11.301658Z",
"id": "CVE-2026-18838",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:37:22.259Z"
}
}
]
}
}
data/2026/19xxx/CVE-2026-19552.json
+45 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PSF",
"dateReserved": "2026-08-11T15:22:01.993Z",
"datePublished": "2026-11-09T14:15:31.799Z",
"dateUpdated": "2026-11-11T00:24:21.738Z"
"dateUpdated": "2026-11-12T16:30:53.287Z"
},
"containers": {
"cna": {
@@ -172,6 +172,50 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T21:04:58.458Z"
}
},
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-295",
"lang": "en",
"description": "CWE-295 Improper Certificate Validation"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:29:34.238521Z",
"id": "CVE-2026-19552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:30:53.287Z"
}
}
]
}
data/2026/62xxx/CVE-2026-62107.json
+61 -63
View File
@@ -8,52 +8,43 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-07-13T06:15:10.221Z",
"datePublished": "2026-09-11T18:12:05.129Z",
"dateUpdated": "2026-09-11T20:19:11.606Z"
"dateUpdated": "2026-11-12T16:41:54.550Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack",
"dateUpdated": "2026-09-11T18:12:05.129Z"
"dateUpdated": "2026-11-12T16:41:54.550Z"
},
"title": "WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability",
"problemTypes": [
"datePublic": "2026-09-11T09:24:36.000Z",
"descriptions": [
{
"descriptions": [
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Object Injection.This issue affects Masteriyo - LMS: from n/a through 3.4.0.",
"supportingMedia": [
{
"lang": "en",
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
"type": "text/html",
"base64": false,
"value": "Deserialization of Untrusted Data vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Object Injection.<p>This issue affects Masteriyo - LMS: from n/a through 3.4.0.</p>"
}
]
}
],
"affected": [
{
"vendor": "masteriyo",
"vendor": "ThemeGrill",
"product": "Masteriyo - LMS",
"packageName": "learning-management-system",
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "learning-management-system",
"product": "Masteriyo - LMS",
"versions": [
{
"lessThanOrEqual": "3.4.0",
"status": "affected",
"version": "n/a",
"version": "0",
"versionType": "custom",
"status": "affected",
"lessThanOrEqual": "3.4.0",
"changes": [
{
"at": "3.4.1",
@@ -64,25 +55,19 @@
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions."
}
],
"value": "Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions."
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-php-object-injection-vulnerability?_s_id=cve",
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-php-object-injection-vulnerability?_s_id=cve"
]
}
],
"credits": [
{
"lang": "en",
"value": "20kilograma | Patchstack Bug Bounty Program",
"type": "finder"
}
],
"metrics": [
@@ -95,6 +80,10 @@
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
@@ -102,41 +91,50 @@
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"version": "3.1",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
"availabilityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "Object Injection"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Update the WordPress Masteriyo - LMS plugin to the latest available version (at least 3.4.1).",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Masteriyo - LMS Plugin to the latest available version (at least 3.4.1)."
"base64": false,
"value": "Update the WordPress Masteriyo - LMS plugin to the latest available version (at least 3.4.1)."
}
],
"value": "Update the WordPress Masteriyo - LMS Plugin to the latest available version (at least 3.4.1)."
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "20kilograma | Patchstack Bug Bounty Program"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
"tags": [
"x_known-exploited-vulnerability",
"x_open-source"
]
},
"adp": [
{
data/2026/63xxx/CVE-2026-63282.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Axis",
"dateReserved": "2026-07-16T08:28:41.292Z",
"datePublished": "2026-11-10T05:23:30.194Z",
"dateUpdated": "2026-11-10T05:23:30.194Z"
"dateUpdated": "2026-11-12T17:13:04.418Z"
},
"containers": {
"cna": {
@@ -133,6 +133,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:12:39.343908Z",
"id": "CVE-2026-63282",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:13:04.418Z"
}
}
]
}
}
data/2026/63xxx/CVE-2026-63288.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Axis",
"dateReserved": "2026-07-16T08:28:41.293Z",
"datePublished": "2026-11-10T05:32:06.255Z",
"dateUpdated": "2026-11-10T05:32:06.255Z"
"dateUpdated": "2026-11-12T17:13:55.816Z"
},
"containers": {
"cna": {
@@ -149,6 +149,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:13:39.276728Z",
"id": "CVE-2026-63288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:13:55.816Z"
}
}
]
}
}
data/2026/76xxx/CVE-2026-76970.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "sap",
"dateReserved": "2026-08-20T05:33:36.764Z",
"datePublished": "2026-11-10T00:18:08.996Z",
"dateUpdated": "2026-11-10T00:18:08.996Z"
"dateUpdated": "2026-11-12T17:07:57.840Z"
},
"containers": {
"cna": {
@@ -151,6 +151,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:07:44.672927Z",
"id": "CVE-2026-76970",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:07:57.840Z"
}
}
]
}
}
data/2026/76xxx/CVE-2026-76973.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "sap",
"dateReserved": "2026-08-20T05:33:36.764Z",
"datePublished": "2026-11-10T00:18:25.840Z",
"dateUpdated": "2026-11-10T00:18:25.840Z"
"dateUpdated": "2026-11-12T17:09:45.229Z"
},
"containers": {
"cna": {
@@ -143,6 +143,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:09:29.422659Z",
"id": "CVE-2026-76973",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:09:45.229Z"
}
}
]
}
}
data/2026/82xxx/CVE-2026-82032.json
+28
View File
@@ -0,0 +1,28 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-82032",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "REJECTED",
"dateReserved": "2026-08-27T21:39:20.460Z",
"dateUpdated": "2026-11-12T16:44:20.347Z",
"dateRejected": "2026-11-12T16:44:20.347Z",
"assignerShortName": "VulnCheck"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T16:44:20.347Z"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
}
}
}
data/2026/82xxx/CVE-2026-82977.json
+89
View File
@@ -0,0 +1,89 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-82977",
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"state": "PUBLISHED",
"assignerShortName": "hackerone",
"dateReserved": "2026-08-31T15:00:00.543Z",
"datePublished": "2026-11-12T17:01:19.318Z",
"dateUpdated": "2026-11-12T17:01:19.318Z"
},
"containers": {
"cna": {
"descriptions": [
{
"lang": "en",
"value": "The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "WebPros",
"product": "Plesk",
"versions": [
{
"version": "18.0.77",
"status": "affected",
"lessThanOrEqual": "18.0.81.7",
"versionType": "semver"
},
{
"version": "18.0.82",
"status": "affected",
"lessThanOrEqual": "18.0.82.2",
"versionType": "semver"
}
]
}
],
"references": [
{
"url": "https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics"
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L",
"baseScore": 8.4,
"baseSeverity": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"lang": "en",
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ady Elouej",
"type": "finder"
}
],
"workarounds": [
{
"lang": "en",
"value": "-"
}
],
"providerMetadata": {
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone",
"dateUpdated": "2026-11-12T17:01:19.318Z"
}
}
}
}
data/2026/84xxx/CVE-2026-84410.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "canonical",
"dateReserved": "2026-09-23T14:22:38.016Z",
"datePublished": "2026-11-09T20:14:43.156Z",
"dateUpdated": "2026-11-09T20:14:43.156Z"
"dateUpdated": "2026-11-12T16:53:34.650Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:52:43.114889Z",
"id": "CVE-2026-84410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:53:34.650Z"
}
}
]
}
}
data/2026/86xxx/CVE-2026-86692.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "canonical",
"dateReserved": "2026-09-23T14:22:38.025Z",
"datePublished": "2026-11-09T20:14:13.349Z",
"dateUpdated": "2026-11-09T20:14:13.349Z"
"dateUpdated": "2026-11-12T16:52:02.441Z"
},
"containers": {
"cna": {
@@ -129,6 +129,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:51:41.653730Z",
"id": "CVE-2026-86692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:52:02.441Z"
}
}
]
}
}
data/2026/87xxx/CVE-2026-87744.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-09T05:58:00.263Z",
"datePublished": "2026-10-12T18:41:46.751Z",
"dateUpdated": "2026-10-15T23:11:43.650Z"
"dateUpdated": "2026-11-12T17:14:26.733Z"
},
"containers": {
"cna": {
@@ -134,14 +134,14 @@
"descriptions": [
{
"cweId": "CWE-425",
"description": "Direct Request ('Forced Browsing')",
"description": "Direct Request",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-425: Direct Request ('Forced Browsing')",
"x_redhatCweChain": "CWE-425: Direct Request",
"workarounds": [
{
"lang": "en",
@@ -169,7 +169,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-10-15T23:11:43.650Z"
"dateUpdated": "2026-11-12T17:14:26.733Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/87xxx/CVE-2026-87857.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Temporal",
"dateReserved": "2026-09-09T13:05:41.629Z",
"datePublished": "2026-11-09T19:45:14.927Z",
"dateUpdated": "2026-11-09T19:45:14.927Z"
"dateUpdated": "2026-11-12T16:49:29.027Z"
},
"containers": {
"cna": {
@@ -329,6 +329,40 @@
"source": {
"discovery": "INTERNAL"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:49:08.520166Z",
"id": "CVE-2026-87857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:49:29.027Z"
}
}
]
}
}
data/2026/90xxx/CVE-2026-90585.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "zephyr",
"dateReserved": "2026-09-12T18:04:35.296Z",
"datePublished": "2026-11-09T22:03:56.009Z",
"dateUpdated": "2026-11-09T22:03:56.009Z"
"dateUpdated": "2026-11-12T17:17:19.801Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:17:07.854312Z",
"id": "CVE-2026-90585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:17:19.801Z"
}
}
]
}
}
data/2026/90xxx/CVE-2026-90586.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "zephyr",
"dateReserved": "2026-09-12T18:04:37.259Z",
"datePublished": "2026-11-09T22:03:58.198Z",
"dateUpdated": "2026-11-09T22:03:58.198Z"
"dateUpdated": "2026-11-12T17:18:01.962Z"
},
"containers": {
"cna": {
@@ -98,6 +98,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T17:17:43.773985Z",
"id": "CVE-2026-90586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T17:18:01.962Z"
}
}
]
}
}
data/2026/91xxx/CVE-2026-91150.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T20:36:53.441Z",
"datePublished": "2026-11-11T18:38:12.565Z",
"dateUpdated": "2026-11-12T13:32:07.208Z"
"dateUpdated": "2026-11-12T16:44:58.470Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4.1-1.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -183,6 +201,14 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:99599",
"name": "RHSA-2026:99599",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99600",
"name": "RHSA-2026:99600",
@@ -272,7 +298,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T13:32:07.208Z"
"dateUpdated": "2026-11-12T16:44:58.470Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91151.json
+28 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T20:37:18.522Z",
"datePublished": "2026-11-11T19:46:14.718Z",
"dateUpdated": "2026-11-12T13:32:07.225Z"
"dateUpdated": "2026-11-12T16:45:02.638Z"
},
"containers": {
"cna": {
@@ -66,6 +66,24 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4.1-1.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
@@ -183,6 +201,14 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:99599",
"name": "RHSA-2026:99599",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99600",
"name": "RHSA-2026:99600",
@@ -272,7 +298,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T13:32:07.225Z"
"dateUpdated": "2026-11-12T16:45:02.638Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91871.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-09-15T10:04:43.433Z",
"datePublished": "2026-11-11T17:41:27.080Z",
"dateUpdated": "2026-11-11T17:41:27.080Z"
"dateUpdated": "2026-11-12T16:23:34.511Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:23:23.301945Z",
"id": "CVE-2026-91871",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:23:34.511Z"
}
}
]
}
}
data/2026/91xxx/CVE-2026-91876.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-09-15T10:04:43.433Z",
"datePublished": "2026-11-11T18:22:41.165Z",
"dateUpdated": "2026-11-11T18:22:41.165Z"
"dateUpdated": "2026-11-12T16:22:49.295Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:22:41.234734Z",
"id": "CVE-2026-91876",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:22:49.295Z"
}
}
]
}
}
data/2026/91xxx/CVE-2026-91880.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-09-15T10:04:43.433Z",
"datePublished": "2026-11-11T18:01:43.171Z",
"dateUpdated": "2026-11-11T18:01:43.171Z"
"dateUpdated": "2026-11-12T16:21:26.372Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:21:04.288816Z",
"id": "CVE-2026-91880",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:21:26.372Z"
}
}
]
}
}
data/2026/96xxx/CVE-2026-96285.json
+52 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-09-22T21:07:41.624Z",
"datePublished": "2026-11-09T09:47:22.524Z",
"dateUpdated": "2026-11-09T09:47:22.524Z"
"dateUpdated": "2026-11-12T16:19:23.426Z"
},
"containers": {
"cna": {
@@ -121,6 +121,56 @@
"x_generator": {
"engine": "airflow-s/generate_cve_json.py"
}
}
},
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T16:19:19.371977Z",
"id": "CVE-2026-96285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T16:19:23.426Z"
}
}
]
}
}
data/delta.json
+54 -401
View File
@@ -1,427 +1,80 @@
{
"fetchTime": "2026-11-12T16:16:46.329Z",
"numberOfChanges": 70,
"new": [],
"fetchTime": "2026-11-12T17:18:40.627Z",
"numberOfChanges": 12,
"new": [
{
"cveId": "CVE-2026-106154",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106154",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106154.json",
"dateUpdated": "2026-11-12T17:13:26.499Z"
}
],
"updated": [
{
"cveId": "CVE-2026-101031",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-101031",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101031.json",
"dateUpdated": "2026-11-12T16:11:23.932Z"
"cveId": "CVE-2026-114032",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114032",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114032.json",
"dateUpdated": "2026-11-12T17:16:38.649Z"
},
{
"cveId": "CVE-2026-107474",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107474",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107474.json",
"dateUpdated": "2026-11-12T16:06:13.098Z"
"cveId": "CVE-2026-124018",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124018",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124018.json",
"dateUpdated": "2026-11-12T17:17:47.526Z"
},
{
"cveId": "CVE-2026-112168",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112168",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112168.json",
"dateUpdated": "2026-11-12T16:08:46.068Z"
"cveId": "CVE-2026-126994",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126994",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126994.json",
"dateUpdated": "2026-11-12T17:17:55.217Z"
},
{
"cveId": "CVE-2026-112169",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112169",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112169.json",
"dateUpdated": "2026-11-12T16:09:21.714Z"
"cveId": "CVE-2026-126998",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126998",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126998.json",
"dateUpdated": "2026-11-12T17:17:39.139Z"
},
{
"cveId": "CVE-2026-112170",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112170",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112170.json",
"dateUpdated": "2026-11-12T16:09:52.614Z"
"cveId": "CVE-2026-127121",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127121",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127121.json",
"dateUpdated": "2026-11-12T17:17:31.603Z"
},
{
"cveId": "CVE-2026-112171",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112171",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112171.json",
"dateUpdated": "2026-11-12T16:10:27.413Z"
"cveId": "CVE-2026-127141",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127141",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127141.json",
"dateUpdated": "2026-11-12T17:17:20.710Z"
},
{
"cveId": "CVE-2026-113504",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-113504",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113504.json",
"dateUpdated": "2026-11-12T16:02:59.170Z"
"cveId": "CVE-2026-63282",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-63282",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63282.json",
"dateUpdated": "2026-11-12T17:13:04.418Z"
},
{
"cveId": "CVE-2026-113508",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-113508",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113508.json",
"dateUpdated": "2026-11-12T16:14:09.433Z"
"cveId": "CVE-2026-63288",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-63288",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63288.json",
"dateUpdated": "2026-11-12T17:13:55.816Z"
},
{
"cveId": "CVE-2026-118450",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118450",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118450.json",
"dateUpdated": "2026-11-12T16:02:56.699Z"
"cveId": "CVE-2026-87744",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-87744",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87744.json",
"dateUpdated": "2026-11-12T17:14:26.733Z"
},
{
"cveId": "CVE-2026-118458",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118458",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118458.json",
"dateUpdated": "2026-11-12T16:03:42.687Z"
"cveId": "CVE-2026-90585",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90585",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90585.json",
"dateUpdated": "2026-11-12T17:17:19.801Z"
},
{
"cveId": "CVE-2026-118459",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118459",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118459.json",
"dateUpdated": "2026-11-12T16:04:20.598Z"
},
{
"cveId": "CVE-2026-118460",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118460",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118460.json",
"dateUpdated": "2026-11-12T16:07:25.645Z"
},
{
"cveId": "CVE-2026-118461",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118461",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118461.json",
"dateUpdated": "2026-11-12T16:06:40.143Z"
},
{
"cveId": "CVE-2026-118791",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118791",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118791.json",
"dateUpdated": "2026-11-12T16:05:56.868Z"
},
{
"cveId": "CVE-2026-118792",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118792",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118792.json",
"dateUpdated": "2026-11-12T16:04:57.172Z"
},
{
"cveId": "CVE-2026-119613",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119613",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119613.json",
"dateUpdated": "2026-11-12T16:11:19.623Z"
},
{
"cveId": "CVE-2026-124741",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124741",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124741.json",
"dateUpdated": "2026-11-12T16:02:07.774Z"
},
{
"cveId": "CVE-2026-125786",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125786",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125786.json",
"dateUpdated": "2026-11-12T16:13:50.513Z"
},
{
"cveId": "CVE-2026-126082",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126082",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126082.json",
"dateUpdated": "2026-11-12T16:02:27.295Z"
},
{
"cveId": "CVE-2026-126840",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126840",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126840.json",
"dateUpdated": "2026-11-12T16:06:18.182Z"
},
{
"cveId": "CVE-2026-126842",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126842",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126842.json",
"dateUpdated": "2026-11-12T16:11:58.901Z"
},
{
"cveId": "CVE-2026-126843",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126843",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126843.json",
"dateUpdated": "2026-11-12T16:07:04.820Z"
},
{
"cveId": "CVE-2026-126846",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126846",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126846.json",
"dateUpdated": "2026-11-12T16:15:12.512Z"
},
{
"cveId": "CVE-2026-126847",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126847",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126847.json",
"dateUpdated": "2026-11-12T16:12:39.983Z"
},
{
"cveId": "CVE-2026-126849",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126849",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126849.json",
"dateUpdated": "2026-11-12T16:05:32.229Z"
},
{
"cveId": "CVE-2026-126851",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126851",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126851.json",
"dateUpdated": "2026-11-12T16:11:03.194Z"
},
{
"cveId": "CVE-2026-126852",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126852",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126852.json",
"dateUpdated": "2026-11-12T16:05:01.146Z"
},
{
"cveId": "CVE-2026-126859",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126859",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126859.json",
"dateUpdated": "2026-11-12T16:14:13.071Z"
},
{
"cveId": "CVE-2026-126860",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126860",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126860.json",
"dateUpdated": "2026-11-12T16:09:14.106Z"
},
{
"cveId": "CVE-2026-126861",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126861",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126861.json",
"dateUpdated": "2026-11-12T16:08:55.614Z"
},
{
"cveId": "CVE-2026-126863",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126863",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126863.json",
"dateUpdated": "2026-11-12T16:10:15.705Z"
},
{
"cveId": "CVE-2026-126864",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126864",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126864.json",
"dateUpdated": "2026-11-12T16:14:42.486Z"
},
{
"cveId": "CVE-2026-126865",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126865",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126865.json",
"dateUpdated": "2026-11-12T16:12:25.017Z"
},
{
"cveId": "CVE-2026-126867",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126867",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126867.json",
"dateUpdated": "2026-11-12T16:11:21.420Z"
},
{
"cveId": "CVE-2026-126868",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126868",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126868.json",
"dateUpdated": "2026-11-12T16:04:45.799Z"
},
{
"cveId": "CVE-2026-126869",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126869",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126869.json",
"dateUpdated": "2026-11-12T16:09:59.152Z"
},
{
"cveId": "CVE-2026-126872",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126872",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126872.json",
"dateUpdated": "2026-11-12T16:10:17.226Z"
},
{
"cveId": "CVE-2026-126873",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126873",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126873.json",
"dateUpdated": "2026-11-12T16:10:44.582Z"
},
{
"cveId": "CVE-2026-126874",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126874",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126874.json",
"dateUpdated": "2026-11-12T16:09:43.142Z"
},
{
"cveId": "CVE-2026-126876",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126876",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126876.json",
"dateUpdated": "2026-11-12T16:09:28.153Z"
},
{
"cveId": "CVE-2026-126879",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126879",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126879.json",
"dateUpdated": "2026-11-12T16:15:26.965Z"
},
{
"cveId": "CVE-2026-126880",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126880",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126880.json",
"dateUpdated": "2026-11-12T16:07:51.129Z"
},
{
"cveId": "CVE-2026-126881",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126881",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126881.json",
"dateUpdated": "2026-11-12T16:10:46.730Z"
},
{
"cveId": "CVE-2026-126885",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126885",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126885.json",
"dateUpdated": "2026-11-12T16:15:56.416Z"
},
{
"cveId": "CVE-2026-126886",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126886",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126886.json",
"dateUpdated": "2026-11-12T16:13:58.134Z"
},
{
"cveId": "CVE-2026-126887",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126887",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126887.json",
"dateUpdated": "2026-11-12T16:13:41.489Z"
},
{
"cveId": "CVE-2026-126888",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126888",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126888.json",
"dateUpdated": "2026-11-12T16:07:19.690Z"
},
{
"cveId": "CVE-2026-126889",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126889",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126889.json",
"dateUpdated": "2026-11-12T16:14:28.051Z"
},
{
"cveId": "CVE-2026-126890",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126890",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126890.json",
"dateUpdated": "2026-11-12T16:04:14.582Z"
},
{
"cveId": "CVE-2026-126892",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126892",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126892.json",
"dateUpdated": "2026-11-12T16:06:49.188Z"
},
{
"cveId": "CVE-2026-126893",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126893",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126893.json",
"dateUpdated": "2026-11-12T16:06:02.670Z"
},
{
"cveId": "CVE-2026-126895",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126895",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126895.json",
"dateUpdated": "2026-11-12T16:15:41.417Z"
},
{
"cveId": "CVE-2026-126897",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126897",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126897.json",
"dateUpdated": "2026-11-12T16:06:34.220Z"
},
{
"cveId": "CVE-2026-126899",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126899",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126899.json",
"dateUpdated": "2026-11-12T16:03:44.004Z"
},
{
"cveId": "CVE-2026-126900",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126900",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126900.json",
"dateUpdated": "2026-11-12T16:11:19.169Z"
},
{
"cveId": "CVE-2026-126901",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126901",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126901.json",
"dateUpdated": "2026-11-12T16:05:16.157Z"
},
{
"cveId": "CVE-2026-126905",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126905",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126905.json",
"dateUpdated": "2026-11-12T16:08:23.268Z"
},
{
"cveId": "CVE-2026-126908",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126908",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126908.json",
"dateUpdated": "2026-11-12T16:05:46.657Z"
},
{
"cveId": "CVE-2026-126909",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126909",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126909.json",
"dateUpdated": "2026-11-12T16:12:56.045Z"
},
{
"cveId": "CVE-2026-126910",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126910",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126910.json",
"dateUpdated": "2026-11-12T16:11:51.282Z"
},
{
"cveId": "CVE-2026-126911",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126911",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126911.json",
"dateUpdated": "2026-11-12T16:14:57.487Z"
},
{
"cveId": "CVE-2026-126912",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126912",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126912.json",
"dateUpdated": "2026-11-12T16:13:27.000Z"
},
{
"cveId": "CVE-2026-126916",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126916",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126916.json",
"dateUpdated": "2026-11-12T16:12:09.011Z"
},
{
"cveId": "CVE-2026-126917",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126917",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126917.json",
"dateUpdated": "2026-11-12T16:08:38.693Z"
},
{
"cveId": "CVE-2026-126918",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126918",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126918.json",
"dateUpdated": "2026-11-12T16:09:11.124Z"
},
{
"cveId": "CVE-2026-126919",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126919",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126919.json",
"dateUpdated": "2026-11-12T16:13:11.542Z"
},
{
"cveId": "CVE-2026-126921",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126921",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126921.json",
"dateUpdated": "2026-11-12T16:04:30.665Z"
},
{
"cveId": "CVE-2026-92683",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92683",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92683.json",
"dateUpdated": "2026-11-12T16:08:55.061Z"
},
{
"cveId": "CVE-2026-95648",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95648",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95648.json",
"dateUpdated": "2026-11-12T16:08:09.366Z"
},
{
"cveId": "CVE-2026-9165",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-9165",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9165.json",
"dateUpdated": "2026-11-12T16:08:03.714Z"
"cveId": "CVE-2026-90586",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90586",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90586.json",
"dateUpdated": "2026-11-12T17:18:01.962Z"
}
],
"error": []
data/deltaLog.json
+669 -1464
View File
File diff suppressed because it is too large. Load diff
state/sync.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"source": "https://github.com/CVEProject/cvelistV5.git",
"upstream_commit": "49cd4a7173467821e8f2b0c98cb0598f8faf63de",
"upstream_commit": "d3c3ef38e967bd4cc0be28ceba0588a49ec2486d",
"since_year": 2017,
"records": 331620,
"synced_at_utc": "2026-11-12T16:26:13.736746+00:00"
"records": 331642,
"synced_at_utc": "2026-11-12T17:26:53.155430+00:00"
}