VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-12T23:30:39Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-13 00:30:44 +01:00
1 parent 2bf21dbf2a
commit 09b9341c0a
36 files changed
+3665 -7758
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2026/103xxx/CVE-2026-103963.json
+110 -41
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-01T15:30:36.833Z",
"datePublished": "2026-10-30T04:08:40.002Z",
"dateUpdated": "2026-11-12T21:26:10.274Z"
"dateUpdated": "2026-11-12T23:00:26.837Z"
},
"containers": {
"cna": {
@@ -48,52 +48,97 @@
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib-networking",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.68.3-3.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib-networking",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.68.3-3.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib-networking",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.80.0-3.el10_3.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib-networking",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.80.0-3.el10_2.4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib-networking",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.68.3-3.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib-networking",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.68.3-3.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "glib-networking",
"defaultStatus": "affected",
"versions": [
{
"version": "0:2.68.3-3.el9_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
@@ -136,6 +181,30 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99696",
"name": "RHSA-2026:99696",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99697",
"name": "RHSA-2026:99697",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99698",
"name": "RHSA-2026:99698",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-103963",
"tags": [
@@ -196,7 +265,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T21:26:10.274Z"
"dateUpdated": "2026-11-12T23:00:26.837Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/108xxx/CVE-2026-108472.json
+100 -22
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-09T22:24:14.527Z",
"datePublished": "2026-11-11T18:38:17.370Z",
"dateUpdated": "2026-11-12T19:41:23.724Z"
"dateUpdated": "2026-11-12T22:58:33.371Z"
},
"containers": {
"cna": {
@@ -66,6 +66,80 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.2 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:6.16.0-2.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:5.0.0-13.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:6.4.0-10.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:6.4.0-10.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
@@ -95,26 +169,6 @@
"cpe:/o:redhat:rhel_els:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "xfsprogs",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
@@ -147,6 +201,14 @@
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:99659",
"name": "RHSA-2026:99659",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99660",
"name": "RHSA-2026:99660",
@@ -155,6 +217,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99661",
"name": "RHSA-2026:99661",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99662",
"name": "RHSA-2026:99662",
@@ -163,6 +233,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99817",
"name": "RHSA-2026:99817",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-108472",
"tags": [
@@ -220,7 +298,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T17:19:10.679Z"
"dateUpdated": "2026-11-12T22:58:33.371Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112315.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:23:58.679Z",
"datePublished": "2026-11-09T19:07:47.557Z",
"dateUpdated": "2026-11-12T18:05:23.617Z"
"dateUpdated": "2026-11-12T23:01:04.402Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112315",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:25.081Z"
"dateUpdated": "2026-11-12T23:01:04.402Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112316.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:24:50.360Z",
"datePublished": "2026-11-09T19:08:00.263Z",
"dateUpdated": "2026-11-12T16:47:29.411Z"
"dateUpdated": "2026-11-12T23:01:04.627Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112316",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:29.411Z"
"dateUpdated": "2026-11-12T23:01:04.627Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112317.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:25:20.662Z",
"datePublished": "2026-11-09T19:07:58.372Z",
"dateUpdated": "2026-11-12T16:47:35.522Z"
"dateUpdated": "2026-11-12T23:01:09.061Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112317",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:35.522Z"
"dateUpdated": "2026-11-12T23:01:09.061Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112318.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:25:59.007Z",
"datePublished": "2026-11-09T19:08:02.661Z",
"dateUpdated": "2026-11-12T16:47:39.479Z"
"dateUpdated": "2026-11-12T23:01:11.090Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112318",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:39.479Z"
"dateUpdated": "2026-11-12T23:01:11.090Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112319.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:26:25.093Z",
"datePublished": "2026-11-09T19:08:05.007Z",
"dateUpdated": "2026-11-12T16:47:44.222Z"
"dateUpdated": "2026-11-12T23:01:14.760Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112319",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:44.222Z"
"dateUpdated": "2026-11-12T23:01:14.760Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112320.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:26:51.377Z",
"datePublished": "2026-11-09T19:08:07.434Z",
"dateUpdated": "2026-11-12T18:05:17.103Z"
"dateUpdated": "2026-11-12T23:01:17.259Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112320",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:49.479Z"
"dateUpdated": "2026-11-12T23:01:17.259Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112321.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:27:17.372Z",
"datePublished": "2026-11-09T19:08:10.347Z",
"dateUpdated": "2026-11-12T16:47:53.597Z"
"dateUpdated": "2026-11-12T23:01:19.403Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112321",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:53.597Z"
"dateUpdated": "2026-11-12T23:01:19.403Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112322.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:27:47.648Z",
"datePublished": "2026-11-09T18:43:23.841Z",
"dateUpdated": "2026-11-12T16:47:57.396Z"
"dateUpdated": "2026-11-12T23:01:23.481Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112322",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:47:57.396Z"
"dateUpdated": "2026-11-12T23:01:23.481Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/112xxx/CVE-2026-112323.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-19T14:29:07.369Z",
"datePublished": "2026-11-09T18:43:29.636Z",
"dateUpdated": "2026-11-12T16:48:02.393Z"
"dateUpdated": "2026-11-12T23:01:25.182Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-112323",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:48:02.393Z"
"dateUpdated": "2026-11-12T23:01:25.182Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/119xxx/CVE-2026-119079.json
+75 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-29T13:10:23.375Z",
"datePublished": "2026-11-09T18:43:39.044Z",
"dateUpdated": "2026-11-12T16:48:13.854Z"
"dateUpdated": "2026-11-12T23:01:31.643Z"
},
"containers": {
"cna": {
@@ -84,6 +84,63 @@
"cpe:/o:redhat:enterprise_linux_eus:10.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_9.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.21.1-10.el9_8.3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
@@ -114,16 +171,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "krb5",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -152,6 +199,22 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99715",
"name": "RHSA-2026:99715",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99716",
"name": "RHSA-2026:99716",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-119079",
"tags": [
@@ -209,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T16:48:13.854Z"
"dateUpdated": "2026-11-12T23:01:31.643Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/126xxx/CVE-2026-126357.json
+98
View File
@@ -0,0 +1,98 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126357",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.227Z",
"datePublished": "2026-11-12T22:18:46.437Z",
"dateUpdated": "2026-11-12T22:18:46.437Z"
},
"containers": {
"cna": {
"title": "Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"lang": "en",
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/honojs/hono/security/advisories/GHSA-4m76-xfj5-7975",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/honojs/hono/security/advisories/GHSA-4m76-xfj5-7975"
},
{
"name": "https://github.com/honojs/hono/commit/34f90432a1794b28e52802670efcd01963f716d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/commit/34f90432a1794b28e52802670efcd01963f716d6"
},
{
"name": "https://github.com/honojs/hono/releases/tag/v4.13.16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/releases/tag/v4.13.16"
}
],
"affected": [
{
"vendor": "honojs",
"product": "hono",
"versions": [
{
"version": "< 4.13.16",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:18:46.437Z"
},
"descriptions": [
{
"lang": "en",
"value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route while the outer application routes the original path. Since 4.12.21, rebuilding the forwarded URL from the decoded pathname can also convert a decoded backslash to a slash and collapse parent-directory segments, again causing the mounted application to receive a protected path. An unauthenticated client can use either applicable path transformation to reach a mounted route without authentication or authorization middleware scoped to a subpath inside the mount prefix. This issue is fixed in version 4.13.16."
}
],
"source": {
"advisory": "GHSA-4m76-xfj5-7975",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126358.json
+98
View File
@@ -0,0 +1,98 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126358",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.227Z",
"datePublished": "2026-11-12T22:21:08.113Z",
"dateUpdated": "2026-11-12T22:21:08.113Z"
},
"containers": {
"cna": {
"title": "Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"lang": "en",
"description": "CWE-863: Incorrect Authorization",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/honojs/hono/security/advisories/GHSA-h7mg-cq63-vhpq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/honojs/hono/security/advisories/GHSA-h7mg-cq63-vhpq"
},
{
"name": "https://github.com/honojs/hono/commit/8a103aa59bcfbffd5396b1548a0dff3688777c36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/commit/8a103aa59bcfbffd5396b1548a0dff3688777c36"
},
{
"name": "https://github.com/honojs/hono/releases/tag/v4.13.16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/releases/tag/v4.13.16"
}
],
"affected": [
{
"vendor": "honojs",
"product": "hono",
"versions": [
{
"version": ">= 4.1.4, < 4.13.16",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:21:08.113Z"
},
"descriptions": [
{
"lang": "en",
"value": "Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant{[^/]+}/admin/* is not applied to a route written as /api/:tenant/admin/:id; since 4.1.4, middleware on /admin/* is not applied to a route registered as /admin* for paths under /admin/; and since 4.4.0, a request path containing an encoded line terminator can reach the not-found handler without wildcard middleware. The default SmartRouter selects RegExpRouter for most applications, and the router's registration-time coverage calculation treated the first two matching pattern pairs as different while its compiled wildcard did not match line terminators in the third case. An unauthenticated client can reach a route handler or the not-found handler without authentication or authorization middleware registered on the wildcard path. TrieRouter, LinearRouter, and PatternRouter apply the middleware in the three described cases. This issue is fixed in version 4.13.16."
}
],
"source": {
"advisory": "GHSA-h7mg-cq63-vhpq",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126359.json
+98
View File
@@ -0,0 +1,98 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126359",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:22:32.161Z",
"dateUpdated": "2026-11-12T22:22:32.161Z"
},
"containers": {
"cna": {
"title": "Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/honojs/hono/security/advisories/GHSA-3gg2-335m-rxc6"
},
{
"name": "https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189db4fd8dc7bf8ef280c513",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189db4fd8dc7bf8ef280c513"
},
{
"name": "https://github.com/honojs/hono/releases/tag/v4.13.16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/releases/tag/v4.13.16"
}
],
"affected": [
{
"vendor": "honojs",
"product": "hono",
"versions": [
{
"version": ">= 3.12.0, < 4.13.16",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:22:32.161Z"
},
"descriptions": [
{
"lang": "en",
"value": "Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when &lt; ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the &lt;Style /&gt; element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after &lt; in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16."
}
],
"source": {
"advisory": "GHSA-3gg2-335m-rxc6",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126360.json
+119
View File
@@ -0,0 +1,119 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126360",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:24:22.023Z",
"dateUpdated": "2026-11-12T22:24:22.023Z"
},
"containers": {
"cna": {
"title": "OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"lang": "en",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-mf5v-w3w3-f6cg"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/pull/5818",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/pull/5818"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/pull/5856",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/pull/5856"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/commit/78123a2755c907c602e02352aebed4be86aa5350"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/commit/faa72dae511ae64a7bf8ca63eff9ad4387d0b939"
},
{
"name": "https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.2"
}
],
"affected": [
{
"vendor": "open-telemetry",
"product": "opentelemetry-python",
"versions": [
{
"version": "< 1.45.2",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:24:22.023Z"
},
"descriptions": [
{
"lang": "en",
"value": "OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2."
}
],
"source": {
"advisory": "GHSA-mf5v-w3w3-f6cg",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126361.json
+118
View File
@@ -0,0 +1,118 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126361",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:26:35.206Z",
"dateUpdated": "2026-11-12T22:26:35.206Z"
},
"containers": {
"cna": {
"title": "Astro: XSS via attribute injection in dynamic tag names",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-184",
"lang": "en",
"description": "CWE-184: Incomplete List of Disallowed Inputs",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/withastro/astro/security/advisories/GHSA-mh32-jxcr-mh9f"
},
{
"name": "https://github.com/withastro/astro/pull/18520",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/pull/18520"
},
{
"name": "https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096"
},
{
"name": "https://github.com/withastro/astro/releases/tag/astro@7.4.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/releases/tag/astro@7.4.5"
}
],
"affected": [
{
"vendor": "withastro",
"product": "astro",
"versions": [
{
"version": "< 7.4.5",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:26:35.206Z"
},
"descriptions": [
{
"lang": "en",
"value": "Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5."
}
],
"source": {
"advisory": "GHSA-mh32-jxcr-mh9f",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126362.json
+101
View File
@@ -0,0 +1,101 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126362",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:29:19.505Z",
"dateUpdated": "2026-11-12T22:29:19.505Z"
},
"containers": {
"cna": {
"title": "Astro: Reflected XSS via unescaped slot names in @astrojs/svelte",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/withastro/astro/security/advisories/GHSA-f4j9-crrj-867q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/withastro/astro/security/advisories/GHSA-f4j9-crrj-867q"
},
{
"name": "https://github.com/withastro/astro/commit/5e476365378e41aa2745d003b2383d02008d7b44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/commit/5e476365378e41aa2745d003b2383d02008d7b44"
},
{
"name": "https://github.com/withastro/astro/releases/tag/@astrojs/svelte@9.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/releases/tag/@astrojs/svelte@9.1.2"
}
],
"affected": [
{
"vendor": "withastro",
"product": "astro",
"versions": [
{
"version": ">= 5.7.3, < 9.1.2",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:29:19.505Z"
},
"descriptions": [
{
"lang": "en",
"value": "Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2."
}
],
"source": {
"advisory": "GHSA-f4j9-crrj-867q",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126363.json
+101
View File
@@ -0,0 +1,101 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126363",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:31:46.889Z",
"dateUpdated": "2026-11-12T22:31:46.889Z"
},
"containers": {
"cna": {
"title": "Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/withastro/astro/security/advisories/GHSA-jmv2-qgxf-f995",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/withastro/astro/security/advisories/GHSA-jmv2-qgxf-f995"
},
{
"name": "https://github.com/withastro/astro/commit/290b196ddb48de11783ff128e2b7272c61490a20",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/commit/290b196ddb48de11783ff128e2b7272c61490a20"
},
{
"name": "https://github.com/withastro/astro/releases/tag/@astrojs/solid-js@7.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/releases/tag/@astrojs/solid-js@7.1.2"
}
],
"affected": [
{
"vendor": "withastro",
"product": "astro",
"versions": [
{
"version": ">= 0.2.0, < 7.1.2",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:31:46.889Z"
},
"descriptions": [
{
"lang": "en",
"value": "Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2."
}
],
"source": {
"advisory": "GHSA-jmv2-qgxf-f995",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126364.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126364",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:33:17.635Z",
"dateUpdated": "2026-11-12T22:33:17.635Z"
},
"containers": {
"cna": {
"title": "Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"lang": "en",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-178",
"lang": "en",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w"
},
{
"name": "https://github.com/withastro/astro/commit/7da442bb286e0c29e1c9e1add6727b7cbf434f1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/commit/7da442bb286e0c29e1c9e1add6727b7cbf434f1a"
},
{
"name": "https://github.com/withastro/astro/releases/tag/astro@7.4.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/releases/tag/astro@7.4.7"
}
],
"affected": [
{
"vendor": "withastro",
"product": "astro",
"versions": [
{
"version": ">= 5.14.3, < 7.4.7",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:33:17.635Z"
},
"descriptions": [
{
"lang": "en",
"value": "Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory only by letter case could therefore pass the containment check, allowing an unauthenticated requester to read image files accepted by the image service from outside the output directory. Exploitation required on-demand rendering with the @astrojs/node adapter, a case-sensitive filesystem, and a preexisting case-variant sibling directory; ordinary traversal to unrelated paths was already rejected. This issue is fixed in Astro version 7.4.7."
}
],
"source": {
"advisory": "GHSA-r3h5-4585-7x3w",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126365.json
+125
View File
@@ -0,0 +1,125 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126365",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:36:18.099Z",
"dateUpdated": "2026-11-12T22:36:18.099Z"
},
"containers": {
"cna": {
"title": "Astro: XSS via unescaped code for unsupported languages in @astrojs/prism",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/withastro/astro/security/advisories/GHSA-ff38-p3qj-4pmf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/withastro/astro/security/advisories/GHSA-ff38-p3qj-4pmf"
},
{
"name": "https://github.com/withastro/astro/commit/edfbf4ab34ff007ae8f7188af76a023a15c9443d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/commit/edfbf4ab34ff007ae8f7188af76a023a15c9443d"
},
{
"name": "https://github.com/withastro/astro/releases/tag/@astrojs/markdoc@2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/releases/tag/@astrojs/markdoc@2.1.2"
},
{
"name": "https://github.com/withastro/astro/releases/tag/@astrojs/prism@4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/withastro/astro/releases/tag/@astrojs/prism@4.1.2"
}
],
"affected": [
{
"vendor": "withastro",
"product": "astro",
"versions": [
{
"version": "< 7.4.3",
"status": "affected"
}
]
},
{
"vendor": "@astrojs",
"product": "prism",
"versions": [
{
"version": "< 4.1.2",
"status": "affected"
}
]
},
{
"vendor": "@astrojs",
"product": "markdoc",
"versions": [
{
"version": ">= 0.3.0, < 2.1.2",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:36:18.099Z"
},
"descriptions": [
{
"lang": "en",
"value": "Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.1.2, runHighlighterWithAstro() returned code unchanged when Prism had no grammar for the requested language, and callers inserted that result as raw HTML. A code block labeled with an unsupported language could therefore render embedded HTML and script instead of displaying it as text. The Prism component was affected when applications supplied untrusted code with an unsupported or attacker-controlled lang, and the @astrojs/markdoc prism() extension was affected for less-trusted content authors even when Markdoc's ordinary HTML rendering was disabled. This issue is fixed in @astrojs/prism 4.1.2 and @astrojs/markdoc 2.1.2."
}
],
"source": {
"advisory": "GHSA-ff38-p3qj-4pmf",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126366.json
+115
View File
@@ -0,0 +1,115 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126366",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:41:38.409Z",
"dateUpdated": "2026-11-12T22:41:38.409Z"
},
"containers": {
"cna": {
"title": "msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"lang": "en",
"description": "CWE-1325: Improperly Controlled Sequential Memory Allocation",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj"
},
{
"name": "https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2"
},
{
"name": "https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6"
},
{
"name": "https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7"
}
],
"affected": [
{
"vendor": "msgpack",
"product": "msgpack-ruby",
"versions": [
{
"version": "< 1.8.7",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:41:38.409Z"
},
"descriptions": [
{
"lang": "en",
"value": "MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding elements or bytes were available. A short MessagePack header could therefore trigger a very large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap. map32 and declared counts at or above 2^31 did not use the affected allocation behavior. This issue is fixed in version 1.8.7."
}
],
"source": {
"advisory": "GHSA-73v3-wf97-vpgj",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/126xxx/CVE-2026-126367.json
+126
View File
@@ -0,0 +1,126 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126367",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:43:36.631Z",
"dateUpdated": "2026-11-12T22:43:36.631Z"
},
"containers": {
"cna": {
"title": "@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-625",
"lang": "en",
"description": "CWE-625: Permissive Regular Expression",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"lang": "en",
"description": "CWE-863: Incorrect Authorization",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-r7hq-q2xm-6c5m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-r7hq-q2xm-6c5m"
},
{
"name": "https://github.com/grpc/grpc-node/commit/3fc3b0ebf7a89d64843a73679951142d33b40cb1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/grpc/grpc-node/commit/3fc3b0ebf7a89d64843a73679951142d33b40cb1"
},
{
"name": "https://github.com/grpc/grpc-node/commit/57a67e96babcb29b6eabc1833221ccf2fa152d43",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/grpc/grpc-node/commit/57a67e96babcb29b6eabc1833221ccf2fa152d43"
},
{
"name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.13.2"
},
{
"name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.14.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.14.2"
}
],
"affected": [
{
"vendor": "grpc",
"product": "grpc-node",
"versions": [
{
"version": "< 1.13.2",
"status": "affected"
},
{
"version": ">= 1.14.0, < 1.14.2",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:43:36.631Z"
},
"descriptions": [
{
"lang": "en",
"value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. An expression intended to match one of several complete values can therefore match a prefix, substring, or suffix. The affected matchers are used for route selection, xDS credential identity matching, and RBAC URL path, principal name, server name, and header rules. An ALLOW policy using an alternation can consequently accept a method, certificate identity, or header value outside the intended set, while a DENY policy becomes broader rather than permissive. This issue is fixed in versions 1.13.2 and 1.14.2."
}
],
"source": {
"advisory": "GHSA-r7hq-q2xm-6c5m",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/127xxx/CVE-2026-127212.json
+154
View File
@@ -0,0 +1,154 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127212",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T16:30:10.903Z",
"datePublished": "2026-11-12T22:20:48.152Z",
"dateUpdated": "2026-11-12T22:20:48.152Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T22:20:48.152Z"
},
"title": "Dokploy < 0.31.1 Broken Access Control via readAppMonitoring",
"descriptions": [
{
"lang": "en",
"value": "Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed \"dokploy\" control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances."
}
],
"tags": [
"x_open-source"
],
"datePublic": "2026-11-12T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "Dokploy",
"product": "dokploy",
"packageURL": "pkg:github/Dokploy/dokploy",
"repo": "https://github.com/Dokploy/dokploy",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThan": "0.31.1"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"version": "3.1",
"baseSeverity": "MEDIUM",
"baseScore": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
}
],
"references": [
{
"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-vxxh-2cp7-gr59",
"name": "GitHub Security Advisory (GHSA-vxxh-2cp7-gr59)",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://github.com/Dokploy/dokploy/releases/tag/v0.31.1",
"name": "Release Notes",
"tags": [
"release-notes",
"patch"
]
},
{
"url": "https://www.vulncheck.com/advisories/dokploy-broken-access-control-via-readappmonitoring",
"name": "VulnCheck Advisory: Dokploy < 0.31.1 Broken Access Control via readAppMonitoring",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "Lazizbek Djurayev (Haad TC)",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2026/127xxx/CVE-2026-127273.json
+178
View File
@@ -0,0 +1,178 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127273",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-12T17:27:31.673Z",
"datePublished": "2026-11-12T23:15:19.116Z",
"dateUpdated": "2026-11-12T23:15:19.116Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-12T23:15:19.116Z"
},
"title": "Linksys EA8100 JNAP API IsAdminPasswordDefault missing authentication",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-306",
"lang": "en",
"description": "Missing Authentication"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-287",
"lang": "en",
"description": "Improper Authentication"
}
]
}
],
"affected": [
{
"vendor": "Linksys",
"product": "EA8100",
"versions": [
{
"version": "1.0.3.216940",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:h:linksys:ea8100:*:*:*:*:*:*:*:*"
],
"modules": [
"JNAP API"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault of the component JNAP API. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 4.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-12T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-12T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-12T18:32:56.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "geochen (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/436428",
"name": "VDB-436428 | Linksys EA8100 JNAP API IsAdminPasswordDefault missing authentication",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/436428/cti",
"name": "VDB-436428 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-127273",
"name": "CVE-2026-127273 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1040994",
"name": "Submit #1040994 | Linksys EA8100 Router 1.0.3.216940 Missing Authentication",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/geo-chen/oss/blob/main/Linksys.md#finding-1-unauthenticated-network-reconnaissance-via-getwanstatusgetwanstatus3isadminpassworddefault-exploitable-cross-origin-via-dns-rebinding",
"tags": [
"exploit"
]
},
{
"url": "https://www.linksys.com/",
"tags": [
"product"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/128xxx/CVE-2026-128065.json
+101
View File
@@ -0,0 +1,101 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128065",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.129Z",
"datePublished": "2026-11-12T22:45:27.060Z",
"dateUpdated": "2026-11-12T22:45:27.060Z"
},
"containers": {
"cna": {
"title": "@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"lang": "en",
"description": "CWE-863: Incorrect Authorization",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827"
},
{
"name": "https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e"
},
{
"name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.14.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.14.2"
}
],
"affected": [
{
"vendor": "grpc",
"product": "grpc-node",
"versions": [
{
"version": ">= 1.14.0, < 1.14.2",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:45:27.060Z"
},
"descriptions": [
{
"lang": "en",
"value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2."
}
],
"source": {
"advisory": "GHSA-gg5j-6742-v827",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128066.json
+108
View File
@@ -0,0 +1,108 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128066",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.129Z",
"datePublished": "2026-11-12T22:47:44.807Z",
"dateUpdated": "2026-11-12T22:47:44.807Z"
},
"containers": {
"cna": {
"title": "Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wqgw-9xfh-qf2g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wqgw-9xfh-qf2g"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/4908edaf7f416616784c7c03d8c1a60153710ffb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/4908edaf7f416616784c7c03d8c1a60153710ffb"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/4b63dffd8a6d980fa0e21b40832fa6cbf033eacf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/4b63dffd8a6d980fa0e21b40832fa6cbf033eacf"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"affected": [
{
"vendor": "python-pillow",
"product": "Pillow",
"versions": [
{
"version": ">= 1.0, < 13.0.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:47:44.807Z"
},
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small crafted TIFF or EXIF-bearing JPEG, PNG, WebP, or MPO can therefore cause memory use quadratic in the input size. TIFF and some JPEG paths trigger parsing during Image.open(), while other formats are exposed when EXIF is requested, including through getexif() or ImageOps.exif_transpose(). The declared pixel dimensions do not bound this metadata allocation, so decompression-bomb checks do not prevent process memory exhaustion. This issue is fixed in version 13.0.0."
}
],
"source": {
"advisory": "GHSA-wqgw-9xfh-qf2g",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128067.json
+108
View File
@@ -0,0 +1,108 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128067",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.129Z",
"datePublished": "2026-11-12T22:49:58.221Z",
"dateUpdated": "2026-11-12T22:49:58.221Z"
},
"containers": {
"cna": {
"title": "Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"lang": "en",
"description": "CWE-787: Out-of-bounds Write",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xcvg-w56q-r89m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xcvg-w56q-r89m"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/53318b50e8e9e85a57d033d4d879e1398d97aeb1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/53318b50e8e9e85a57d033d4d879e1398d97aeb1"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/ec5f1cbcf67275641abaad5c065ffb64a0a804a9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/ec5f1cbcf67275641abaad5c065ffb64a0a804a9"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"affected": [
{
"vendor": "python-pillow",
"product": "Pillow",
"versions": [
{
"version": ">= 2.3.0, < 13.0.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-12T22:49:58.221Z"
},
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0."
}
],
"source": {
"advisory": "GHSA-xcvg-w56q-r89m",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/18xxx/CVE-2026-18963.json
+54 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-08-05T15:00:40.360Z",
"datePublished": "2026-08-18T17:05:07.478Z",
"dateUpdated": "2026-11-12T18:59:23.349Z"
"dateUpdated": "2026-11-12T22:37:38.819Z"
},
"containers": {
"cna": {
@@ -234,6 +234,24 @@
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"defaultStatus": "affected",
"versions": [
{
"version": "0:18.0.21-1.redhat_00001.1.el8sso",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 9",
@@ -252,6 +270,24 @@
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
]
},
{
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rh-sso-7/sso76-openshift-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "7.6-88",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
@@ -312,6 +348,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99765",
"name": "RHSA-2026:99765",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99766",
"name": "RHSA-2026:99766",
@@ -320,6 +364,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99767",
"name": "RHSA-2026:99767",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-18963",
"tags": [
@@ -377,7 +429,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T18:59:23.349Z"
"dateUpdated": "2026-11-12T22:37:38.819Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/46xxx/CVE-2026-46448.json
+5 -2
View File
@@ -5,7 +5,7 @@
"cveId": "CVE-2026-46448",
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"dateUpdated": "2026-06-17T12:17:30.606Z",
"dateUpdated": "2026-11-12T23:04:30.806Z",
"dateReserved": "2026-05-14T00:00:00.000Z",
"datePublished": "2026-06-16T00:00:00.000Z"
},
@@ -134,12 +134,15 @@
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/16/5"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00026.html"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-06-16T19:16:38.300Z"
"dateUpdated": "2026-11-12T23:04:30.806Z"
}
},
{
data/2026/92xxx/CVE-2026-92735.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-92735",
"assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"state": "PUBLISHED",
"assignerShortName": "HashiCorp",
"dateReserved": "2026-09-16T18:24:56.213Z",
"datePublished": "2026-11-12T22:31:44.506Z",
"dateUpdated": "2026-11-12T22:31:44.506Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Vault",
"repo": "https://github.com/hashicorp/vault",
"vendor": "HashiCorp",
"versions": [
{
"lessThan": "2.2.2",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Vault Enterprise",
"repo": "https://github.com/hashicorp/vault",
"vendor": "HashiCorp",
"versions": [
{
"changes": [
{
"at": "1.19.25",
"status": "unaffected"
},
{
"at": "1.21.14",
"status": "unaffected"
}
],
"lessThan": "2.2.2",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.</p><br/>"
}
],
"value": "HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664: Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"shortName": "HashiCorp",
"dateUpdated": "2026-11-12T22:31:44.506Z"
},
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials/78198"
}
],
"source": {
"advisory": "HCSEC-2026-55",
"discovery": "EXTERNAL"
},
"title": "Vault integrated storage join may disclose server environment credentials"
}
}
}
data/2026/93xxx/CVE-2026-93333.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-93333",
"assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"state": "PUBLISHED",
"assignerShortName": "HashiCorp",
"dateReserved": "2026-09-17T17:49:53.979Z",
"datePublished": "2026-11-12T22:32:43.853Z",
"dateUpdated": "2026-11-12T22:32:43.853Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Vault",
"repo": "https://github.com/hashicorp/vault",
"vendor": "HashiCorp",
"versions": [
{
"lessThan": "2.2.2",
"status": "affected",
"version": "0.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Vault Enterprise",
"repo": "https://github.com/hashicorp/vault",
"vendor": "HashiCorp",
"versions": [
{
"changes": [
{
"at": "1.19.25",
"status": "unaffected"
},
{
"at": "1.21.14",
"status": "unaffected"
}
],
"lessThan": "2.2.2",
"status": "affected",
"version": "0.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.</p><br/>"
}
],
"value": "Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."
}
],
"impacts": [
{
"capecId": "CAPEC-39",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-39: Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"shortName": "HashiCorp",
"dateUpdated": "2026-11-12T22:32:43.853Z"
},
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200"
}
],
"source": {
"advisory": "HCSEC-2026-57",
"discovery": "EXTERNAL"
},
"title": "Vault audit device prefix vulnerable to log injection"
}
}
}
data/2026/93xxx/CVE-2026-93335.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-93335",
"assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"state": "PUBLISHED",
"assignerShortName": "HashiCorp",
"dateReserved": "2026-09-17T17:54:44.624Z",
"datePublished": "2026-11-12T22:32:14.454Z",
"dateUpdated": "2026-11-12T22:32:14.454Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Vault",
"repo": "https://github.com/hashicorp/vault",
"vendor": "HashiCorp",
"versions": [
{
"lessThan": "2.2.2",
"status": "affected",
"version": "0.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Vault Enterprise",
"repo": "https://github.com/hashicorp/vault",
"vendor": "HashiCorp",
"versions": [
{
"changes": [
{
"at": "1.19.25",
"status": "unaffected"
},
{
"at": "1.21.14",
"status": "unaffected"
}
],
"lessThan": "2.2.2",
"status": "affected",
"version": "0.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported to HashiCorp by Tal Vaknin and other internal and external parties."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.</p><br/>"
}
],
"value": "Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-647",
"description": "CWE-647: Non-Canonical URL Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"shortName": "HashiCorp",
"dateUpdated": "2026-11-12T22:32:14.454Z"
},
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199"
}
],
"source": {
"advisory": "HCSEC-2026-56",
"discovery": "EXTERNAL"
},
"title": "Vault vulnerable to ACL deny bypass via trailing slash"
}
}
}
data/delta.json
+6 -12
View File
@@ -1,18 +1,12 @@
{
"fetchTime": "2026-11-12T22:18:40.976Z",
"numberOfChanges": 2,
"fetchTime": "2026-11-12T23:17:34.003Z",
"numberOfChanges": 1,
"new": [
{
"cveId": "CVE-2026-126355",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126355",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126355.json",
"dateUpdated": "2026-11-12T22:14:05.768Z"
},
{
"cveId": "CVE-2026-126356",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126356",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126356.json",
"dateUpdated": "2026-11-12T22:17:35.051Z"
"cveId": "CVE-2026-127273",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127273",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127273.json",
"dateUpdated": "2026-11-12T23:15:19.116Z"
}
],
"updated": [],
data/deltaLog.json
+331 -7556
View File
File diff suppressed because it is too large. Load diff
state/sync.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"source": "https://github.com/CVEProject/cvelistV5.git",
"upstream_commit": "9e2be4d3fd1acdd605f42f7379e4118c498c720b",
"upstream_commit": "8e6a13cd7132da864cc58f131b91716459e0e8dd",
"since_year": 2017,
"records": 331758,
"synced_at_utc": "2026-11-12T22:28:24.072477+00:00"
"records": 331777,
"synced_at_utc": "2026-11-12T23:25:41.521147+00:00"
}