VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-12T14:29:06Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-12 15:29:10 +01:00
1 parent 3ee83e37cf
commit 24315563e6
57 files changed
+3283 -1450
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2026/100xxx/CVE-2026-100229.json
+7 -166
View File
@@ -4,188 +4,29 @@
"cveMetadata": {
"cveId": "CVE-2026-100229",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"state": "REJECTED",
"assignerShortName": "redhat",
"dateReserved": "2026-09-25T15:24:07.433Z",
"datePublished": "2026-10-14T10:02:12.688Z",
"dateUpdated": "2026-11-06T17:49:26.481Z"
"dateUpdated": "2026-11-12T14:02:33.097Z",
"dateRejected": "2026-11-12T14:02:33.097Z"
},
"containers": {
"cna": {
"title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check",
"metrics": [
{
"other": {
"content": {
"value": "Low",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
"rejectedReasons": [
{
"lang": "en",
"value": "A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gstreamer1-plugins-bad-free",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gstreamer1-plugins-bad-free",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gstreamer1-plugins-bad-free",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gstreamer1-plugins-bad-free",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-100229",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541471",
"name": "RHBZ#2541471",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-10-14T08:10:08.762Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-787: Out-of-bounds Write",
"workarounds": [
{
"lang": "en",
"value": "No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-14T08:10:08.762Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Bruno Fournier for reporting this issue."
"value": "No standard GStreamer pipeline element invokes the vulnerable parser API. Exploitation would require a third-party application to call it with attacker-controlled H.266 DCI data."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-06T17:49:26.481Z"
"dateUpdated": "2026-11-12T14:02:33.097Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-10-14T14:11:42.472789Z",
"id": "CVE-2026-100229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-10-14T14:11:54.060Z"
}
}
]
}
}
}
data/2026/107xxx/CVE-2026-107240.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "hackerone",
"dateReserved": "2026-10-07T15:00:00.550Z",
"datePublished": "2026-11-10T00:32:37.066Z",
"dateUpdated": "2026-11-10T00:32:37.066Z"
"dateUpdated": "2026-11-12T13:31:47.313Z"
},
"containers": {
"cna": {
@@ -125,6 +125,40 @@
"shortName": "hackerone",
"dateUpdated": "2026-11-10T00:32:37.066Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:31:28.099245Z",
"id": "CVE-2026-107240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:31:47.313Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107241.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "hackerone",
"dateReserved": "2026-10-07T15:00:00.550Z",
"datePublished": "2026-11-10T00:32:36.938Z",
"dateUpdated": "2026-11-10T00:32:36.938Z"
"dateUpdated": "2026-11-12T13:30:09.243Z"
},
"containers": {
"cna": {
@@ -125,6 +125,40 @@
"shortName": "hackerone",
"dateUpdated": "2026-11-10T00:32:36.938Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:29:46.349823Z",
"id": "CVE-2026-107241",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:30:09.243Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107242.json
+52 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "hackerone",
"dateReserved": "2026-10-07T15:00:00.550Z",
"datePublished": "2026-11-10T00:32:37.037Z",
"dateUpdated": "2026-11-10T00:32:37.037Z"
"dateUpdated": "2026-11-12T13:31:09.492Z"
},
"containers": {
"cna": {
@@ -115,6 +115,56 @@
"shortName": "hackerone",
"dateUpdated": "2026-11-10T00:32:37.037Z"
}
}
},
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:30:45.489761Z",
"id": "CVE-2026-107242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:31:09.492Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107243.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "hackerone",
"dateReserved": "2026-10-07T15:00:00.550Z",
"datePublished": "2026-11-10T00:32:36.888Z",
"dateUpdated": "2026-11-10T00:32:36.888Z"
"dateUpdated": "2026-11-12T13:28:18.397Z"
},
"containers": {
"cna": {
@@ -125,6 +125,40 @@
"shortName": "hackerone",
"dateUpdated": "2026-11-10T00:32:36.888Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:28:08.560396Z",
"id": "CVE-2026-107243",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:28:18.397Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107244.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "hackerone",
"dateReserved": "2026-10-07T15:00:00.550Z",
"datePublished": "2026-11-10T00:32:36.935Z",
"dateUpdated": "2026-11-10T00:32:36.935Z"
"dateUpdated": "2026-11-12T13:29:03.503Z"
},
"containers": {
"cna": {
@@ -125,6 +125,40 @@
"shortName": "hackerone",
"dateUpdated": "2026-11-10T00:32:36.935Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:28:44.669092Z",
"id": "CVE-2026-107244",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:29:03.503Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107245.json
+52 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "hackerone",
"dateReserved": "2026-10-07T15:00:00.550Z",
"datePublished": "2026-11-10T00:32:37.094Z",
"dateUpdated": "2026-11-10T00:32:37.094Z"
"dateUpdated": "2026-11-12T13:27:44.294Z"
},
"containers": {
"cna": {
@@ -108,6 +108,56 @@
"shortName": "hackerone",
"dateUpdated": "2026-11-10T00:32:37.094Z"
}
}
},
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:27:13.231481Z",
"id": "CVE-2026-107245",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:27:44.294Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107246.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "hackerone",
"dateReserved": "2026-10-07T15:00:00.550Z",
"datePublished": "2026-11-10T00:33:12.589Z",
"dateUpdated": "2026-11-10T00:33:12.589Z"
"dateUpdated": "2026-11-12T13:26:06.861Z"
},
"containers": {
"cna": {
@@ -72,6 +72,40 @@
"shortName": "hackerone",
"dateUpdated": "2026-11-10T00:33:12.589Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:25:49.064016Z",
"id": "CVE-2026-107246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:26:06.861Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107484.json
+112
View File
@@ -0,0 +1,112 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107484",
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"state": "PUBLISHED",
"assignerShortName": "checkpoint",
"dateReserved": "2026-10-08T08:05:06.814Z",
"datePublished": "2026-11-12T14:01:05.395Z",
"dateUpdated": "2026-11-12T14:01:05.395Z"
},
"containers": {
"cna": {
"affected": [
{
"product": "Quantum Security Gateway",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 50 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 130 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 173 or below"
}
]
},
{
"product": "Quantum Security Management",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 50 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 130 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 173 or below"
}
]
}
],
"title": "Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user",
"descriptions": [
{
"lang": "en",
"value": "An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management.",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint",
"dateUpdated": "2026-11-12T14:01:05.395Z"
},
"references": [
{
"url": "https://support.checkpoint.com/results/sk/sk1000291"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/110xxx/CVE-2026-110697.json
+5 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-14T14:10:16.450Z",
"datePublished": "2026-11-11T17:06:13.261Z",
"dateUpdated": "2026-11-11T17:06:13.261Z"
"dateUpdated": "2026-11-12T13:23:12.005Z"
},
"containers": {
"cna": {
@@ -97,6 +97,9 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/solutions/7149592"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552237",
"name": "RHBZ#2552237",
@@ -147,7 +150,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T17:06:13.261Z"
"dateUpdated": "2026-11-12T13:23:12.005Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/116xxx/CVE-2026-116835.json
+125
View File
@@ -0,0 +1,125 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116835",
"assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"state": "PUBLISHED",
"assignerShortName": "Octopus",
"dateReserved": "2026-10-26T23:57:43.332Z",
"datePublished": "2026-11-12T13:23:53.793Z",
"dateUpdated": "2026-11-12T13:23:53.793Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"shortName": "Octopus",
"dateUpdated": "2026-11-12T13:23:53.793Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Octopus Deploy",
"product": "Octopus Server",
"platforms": [
"Windows",
"Linux"
],
"versions": [
{
"status": "affected",
"version": "2025.3.11571",
"lessThan": "2026.2.13503",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.3.0",
"lessThan": "2026.3.15894",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity."
}
]
}
],
"references": [
{
"url": "https://advisories.octopus.com/post/2026/sa2026-22"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was found by Terry Rossow",
"type": "finder"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/120xxx/CVE-2026-120490.json
+90
View File
@@ -0,0 +1,90 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120490",
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"state": "PUBLISHED",
"assignerShortName": "checkpoint",
"dateReserved": "2026-11-02T14:05:57.337Z",
"datePublished": "2026-11-12T14:01:48.152Z",
"dateUpdated": "2026-11-12T14:01:48.152Z"
},
"containers": {
"cna": {
"affected": [
{
"product": "Scalable Platforms (ElasticXL, Maestro, Chassis)",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 130 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 173 or below"
}
]
}
],
"title": "Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms",
"descriptions": [
{
"lang": "en",
"value": "On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-696",
"description": "CWE-696: Incorrect Behavior Order.",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint",
"dateUpdated": "2026-11-12T14:01:48.152Z"
},
"references": [
{
"url": "https://support.checkpoint.com/results/sk/sk1000364"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
}
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/120xxx/CVE-2026-120740.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-02T20:44:20.600Z",
"datePublished": "2026-11-02T21:54:45.435Z",
"dateUpdated": "2026-11-07T02:26:07.854Z"
"dateUpdated": "2026-11-12T13:30:22.635Z"
},
"containers": {
"cna": {
@@ -161,7 +161,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-06T17:58:11.620Z"
"dateUpdated": "2026-11-12T13:30:22.635Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/120xxx/CVE-2026-120869.json
+98
View File
@@ -0,0 +1,98 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120869",
"assignerOrgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
"state": "PUBLISHED",
"assignerShortName": "NetScaler",
"dateReserved": "2026-11-03T00:53:55.696Z",
"datePublished": "2026-11-12T14:03:14.594Z",
"dateUpdated": "2026-11-12T14:03:14.594Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
"shortName": "NetScaler",
"dateUpdated": "2026-11-12T14:03:14.594Z"
},
"title": "An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance",
"datePublic": "2026-11-12T13:57:00.000Z",
"affected": [
{
"vendor": "Citrix NetScaler",
"product": "Console",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "14.1-74.34",
"versionType": "patch"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance "
}
]
}
],
"references": [
{
"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "CRITICAL",
"baseScore": 9.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/121xxx/CVE-2026-121562.json
+33 -15
View File
@@ -8,16 +8,15 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-03T14:46:18.615Z",
"datePublished": "2026-11-03T15:17:17.803Z",
"dateUpdated": "2026-11-09T15:18:59.931Z"
"dateUpdated": "2026-11-12T13:24:03.317Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-03T15:17:17.803Z"
"dateUpdated": "2026-11-12T13:24:03.317Z"
},
"datePublic": "2026-08-18T00:00:00.000Z",
"title": "CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint",
"descriptions": [
{
@@ -25,6 +24,7 @@
"value": "CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled."
}
],
"datePublic": "2026-08-18T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
@@ -57,13 +57,12 @@
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ctfd:ctfd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.8.7",
"versionStartIncluding": "3.1.0"
"versionStartIncluding": "3.1.0",
"versionEndExcluding": "3.8.7"
}
]
}
@@ -73,29 +72,46 @@
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@@ -104,8 +120,10 @@
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"version": "3.1",
"baseSeverity": "MEDIUM",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
}
],
@@ -160,7 +178,7 @@
"credits": [
{
"lang": "en",
"value": "Oceanwarranty (ASK PENTEST SDN. BHD.)",
"value": "oceanwarranty (Adgepuk Research)",
"type": "finder"
},
{
data/2026/123xxx/CVE-2026-123039.json
+126
View File
@@ -0,0 +1,126 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123039",
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"state": "PUBLISHED",
"assignerShortName": "checkpoint",
"dateReserved": "2026-11-05T07:30:18.138Z",
"datePublished": "2026-11-12T14:02:13.665Z",
"dateUpdated": "2026-11-12T14:02:13.665Z"
},
"containers": {
"cna": {
"affected": [
{
"product": "Quantum Security Gateway",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 50 or below"
},
{
"status": "affected",
"version": "R82.20 with Jumbo Hotfix Take 10 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 130 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 173 or below"
}
]
},
{
"product": "Quantum Security Management",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 50 or below"
},
{
"status": "affected",
"version": "R82.20 with Jumbo Hotfix Take 10 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 130 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 173 or below"
}
]
}
],
"title": "Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket",
"descriptions": [
{
"lang": "en",
"value": "The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization.",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource.",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint",
"dateUpdated": "2026-11-12T14:02:13.665Z"
},
"references": [
{
"url": "https://support.checkpoint.com/results/sk/sk1000362"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/123xxx/CVE-2026-123507.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:46:28.480Z",
"datePublished": "2026-11-08T01:37:21.778Z",
"dateUpdated": "2026-11-08T01:37:21.778Z"
"dateUpdated": "2026-11-12T13:57:08.846Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:56:56.888903Z",
"id": "CVE-2026-123507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:57:08.846Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123511.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:46:28.480Z",
"datePublished": "2026-11-08T01:37:24.519Z",
"dateUpdated": "2026-11-08T01:37:24.519Z"
"dateUpdated": "2026-11-12T13:58:29.290Z"
},
"containers": {
"cna": {
@@ -133,6 +133,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:58:19.255277Z",
"id": "CVE-2026-123511",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:58:29.290Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123515.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:47:14.649Z",
"datePublished": "2026-11-08T01:37:27.267Z",
"dateUpdated": "2026-11-08T01:37:27.267Z"
"dateUpdated": "2026-11-12T13:59:20.368Z"
},
"containers": {
"cna": {
@@ -133,6 +133,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:59:10.739299Z",
"id": "CVE-2026-123515",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:59:20.368Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123519.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:47:14.649Z",
"datePublished": "2026-11-08T01:37:30.384Z",
"dateUpdated": "2026-11-08T01:37:30.384Z"
"dateUpdated": "2026-11-12T14:00:45.906Z"
},
"containers": {
"cna": {
@@ -140,6 +140,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g2xc-jv9q-46wq",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:00:16.466685Z",
"id": "CVE-2026-123519",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:00:45.906Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123523.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:47:14.650Z",
"datePublished": "2026-11-08T01:37:33.144Z",
"dateUpdated": "2026-11-08T01:37:33.144Z"
"dateUpdated": "2026-11-12T14:03:34.788Z"
},
"containers": {
"cna": {
@@ -140,6 +140,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3x3m-2j93-w46j",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:03:09.361225Z",
"id": "CVE-2026-123523",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:03:34.788Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123527.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:48:01.381Z",
"datePublished": "2026-11-08T01:37:36.283Z",
"dateUpdated": "2026-11-08T01:37:36.283Z"
"dateUpdated": "2026-11-12T14:04:40.567Z"
},
"containers": {
"cna": {
@@ -141,6 +141,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-j5v7-qcwp-5g32",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:04:16.854468Z",
"id": "CVE-2026-123527",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:04:40.567Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123531.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:48:01.382Z",
"datePublished": "2026-11-08T01:37:40.281Z",
"dateUpdated": "2026-11-08T01:37:40.281Z"
"dateUpdated": "2026-11-12T14:06:05.424Z"
},
"containers": {
"cna": {
@@ -148,6 +148,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v579-5fwc-gr28",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:05:28.548187Z",
"id": "CVE-2026-123531",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:06:05.424Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123535.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:48:46.279Z",
"datePublished": "2026-11-08T01:37:43.142Z",
"dateUpdated": "2026-11-08T01:37:43.142Z"
"dateUpdated": "2026-11-12T14:06:57.116Z"
},
"containers": {
"cna": {
@@ -147,6 +147,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:06:46.387900Z",
"id": "CVE-2026-123535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:06:57.116Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123539.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:48:46.279Z",
"datePublished": "2026-11-08T01:37:45.918Z",
"dateUpdated": "2026-11-08T01:37:45.918Z"
"dateUpdated": "2026-11-12T14:07:56.763Z"
},
"containers": {
"cna": {
@@ -155,6 +155,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:07:47.160665Z",
"id": "CVE-2026-123539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:07:56.763Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123543.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:48:46.279Z",
"datePublished": "2026-11-08T01:37:49.366Z",
"dateUpdated": "2026-11-08T01:37:49.366Z"
"dateUpdated": "2026-11-12T14:08:49.224Z"
},
"containers": {
"cna": {
@@ -262,6 +262,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:08:28.633965Z",
"id": "CVE-2026-123543",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:08:49.224Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123588.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:57:31.045Z",
"datePublished": "2026-11-08T01:38:20.288Z",
"dateUpdated": "2026-11-08T01:38:20.288Z"
"dateUpdated": "2026-11-12T13:26:43.055Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:26:05.562861Z",
"id": "CVE-2026-123588",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:26:43.055Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123592.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T00:57:31.045Z",
"datePublished": "2026-11-08T01:38:23.037Z",
"dateUpdated": "2026-11-08T01:38:23.037Z"
"dateUpdated": "2026-11-12T13:28:44.753Z"
},
"containers": {
"cna": {
@@ -130,6 +130,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:28:26.199703Z",
"id": "CVE-2026-123592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:28:44.753Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123596.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T01:00:16.505Z",
"datePublished": "2026-11-08T01:38:25.747Z",
"dateUpdated": "2026-11-08T01:38:25.747Z"
"dateUpdated": "2026-11-12T13:30:41.852Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:29:11.074677Z",
"id": "CVE-2026-123596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:30:41.852Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123600.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T01:00:16.506Z",
"datePublished": "2026-11-08T01:38:28.487Z",
"dateUpdated": "2026-11-08T01:38:28.487Z"
"dateUpdated": "2026-11-12T13:32:13.625Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:31:58.265865Z",
"id": "CVE-2026-123600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:32:13.625Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123604.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T01:00:16.506Z",
"datePublished": "2026-11-08T01:38:31.351Z",
"dateUpdated": "2026-11-08T01:38:31.351Z"
"dateUpdated": "2026-11-12T13:34:44.888Z"
},
"containers": {
"cna": {
@@ -130,6 +130,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:34:10.429278Z",
"id": "CVE-2026-123604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:34:44.888Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123608.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T01:02:39.794Z",
"datePublished": "2026-11-08T01:38:34.124Z",
"dateUpdated": "2026-11-08T01:38:34.124Z"
"dateUpdated": "2026-11-12T13:38:37.673Z"
},
"containers": {
"cna": {
@@ -130,6 +130,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:38:03.162843Z",
"id": "CVE-2026-123608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:38:37.673Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123612.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T01:02:39.794Z",
"datePublished": "2026-11-08T01:38:36.873Z",
"dateUpdated": "2026-11-08T01:38:36.873Z"
"dateUpdated": "2026-11-12T13:40:04.848Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:38:50.344082Z",
"id": "CVE-2026-123612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:40:04.848Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123710.json
+5 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-06T10:23:55.509Z",
"datePublished": "2026-11-11T15:02:31.341Z",
"dateUpdated": "2026-11-11T15:02:31.341Z"
"dateUpdated": "2026-11-12T13:23:15.408Z"
},
"containers": {
"cna": {
@@ -87,6 +87,9 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/solutions/7149923"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568072",
"name": "RHBZ#2568072",
@@ -137,7 +140,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T15:02:31.341Z"
"dateUpdated": "2026-11-12T13:23:15.408Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124018.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124018",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.544Z",
"datePublished": "2026-11-12T13:35:12.175Z",
"dateUpdated": "2026-11-12T13:35:12.175Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-12T13:35:12.175Z"
},
"title": "Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission",
"descriptions": [
{
"lang": "en",
"value": "Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation."
}
],
"tags": [
"x_open-source"
],
"datePublic": "2026-11-09T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"cweId": "CWE-1236",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "Jegstudio",
"product": "Gutenverse Form – Contact Form Builder, Block Form & Booking Form",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThan": "3.2.2"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"version": "3.1",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
}
],
"references": [
{
"url": "https://wordpress.org/plugins/gutenverse-form/#developers",
"name": "WordPress Changelog",
"tags": [
"release-notes",
"patch"
]
},
{
"url": "https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission",
"name": "VulnCheck Advisory: Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "buiih",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2026/124xxx/CVE-2026-124463.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:15:45.476Z",
"datePublished": "2026-11-08T13:15:49.914Z",
"dateUpdated": "2026-11-08T13:15:49.914Z"
"dateUpdated": "2026-11-12T13:43:28.529Z"
},
"containers": {
"cna": {
@@ -139,6 +139,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:42:52.516039Z",
"id": "CVE-2026-124463",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:43:28.529Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124468.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:16:30.558Z",
"datePublished": "2026-11-08T13:15:52.597Z",
"dateUpdated": "2026-11-08T13:15:52.597Z"
"dateUpdated": "2026-11-12T13:48:23.776Z"
},
"containers": {
"cna": {
@@ -153,6 +153,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-fhc4-8f9p-8mcc",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:46:43.502838Z",
"id": "CVE-2026-124468",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:48:23.776Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124472.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:16:30.558Z",
"datePublished": "2026-11-08T13:15:55.272Z",
"dateUpdated": "2026-11-08T13:15:55.272Z"
"dateUpdated": "2026-11-12T13:51:25.154Z"
},
"containers": {
"cna": {
@@ -139,6 +139,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-74j7-7q95-rvxg",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:49:13.981966Z",
"id": "CVE-2026-124472",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:51:25.154Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124477.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:17:31.140Z",
"datePublished": "2026-11-08T13:15:57.970Z",
"dateUpdated": "2026-11-08T13:15:57.970Z"
"dateUpdated": "2026-11-12T13:52:14.143Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:51:59.660680Z",
"id": "CVE-2026-124477",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:52:14.143Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124481.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:17:31.141Z",
"datePublished": "2026-11-08T13:16:00.737Z",
"dateUpdated": "2026-11-08T13:16:00.737Z"
"dateUpdated": "2026-11-12T13:54:15.618Z"
},
"containers": {
"cna": {
@@ -146,6 +146,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-525m-fch5-vqqm",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T13:53:44.721798Z",
"id": "CVE-2026-124481",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T13:54:15.618Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124485.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:21:16.290Z",
"datePublished": "2026-11-08T13:16:03.710Z",
"dateUpdated": "2026-11-08T13:16:03.710Z"
"dateUpdated": "2026-11-12T14:07:37.412Z"
},
"containers": {
"cna": {
@@ -146,6 +146,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-v688-m84c-5h4v",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:06:45.384491Z",
"id": "CVE-2026-124485",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:07:37.412Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124489.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:21:16.290Z",
"datePublished": "2026-11-08T13:16:06.460Z",
"dateUpdated": "2026-11-08T13:16:06.460Z"
"dateUpdated": "2026-11-12T14:09:00.349Z"
},
"containers": {
"cna": {
@@ -149,6 +149,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-j2cx-3p5q-ppx5",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:08:38.290758Z",
"id": "CVE-2026-124489",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:09:00.349Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124493.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T02:21:16.290Z",
"datePublished": "2026-11-08T13:16:09.204Z",
"dateUpdated": "2026-11-08T13:16:09.204Z"
"dateUpdated": "2026-11-12T14:12:42.900Z"
},
"containers": {
"cna": {
@@ -105,6 +105,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:11:31.348805Z",
"id": "CVE-2026-124493",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:12:42.900Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124627.json
+125
View File
@@ -0,0 +1,125 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124627",
"assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"state": "PUBLISHED",
"assignerShortName": "Octopus",
"dateReserved": "2026-11-09T07:18:04.309Z",
"datePublished": "2026-11-12T13:28:50.375Z",
"dateUpdated": "2026-11-12T13:28:50.375Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"shortName": "Octopus",
"dateUpdated": "2026-11-12T13:28:50.375Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Octopus Deploy",
"product": "Octopus Server",
"platforms": [
"Windows",
"Linux"
],
"versions": [
{
"status": "affected",
"version": "3.0.0",
"lessThan": "2026.2.13526",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.3.0",
"lessThan": "2026.3.15926",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams."
}
]
}
],
"references": [
{
"url": "https://advisories.octopus.com/post/2026/sa2026-23"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was found by Nathan Willoughby",
"type": "finder"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/124xxx/CVE-2026-124628.json
+125
View File
@@ -0,0 +1,125 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124628",
"assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"state": "PUBLISHED",
"assignerShortName": "Octopus",
"dateReserved": "2026-11-09T07:18:04.309Z",
"datePublished": "2026-11-12T13:32:02.094Z",
"dateUpdated": "2026-11-12T13:32:02.094Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"shortName": "Octopus",
"dateUpdated": "2026-11-12T13:32:02.094Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Octopus Deploy",
"product": "Octopus Server",
"platforms": [
"Windows",
"Linux"
],
"versions": [
{
"status": "affected",
"version": "2018.3.0",
"lessThan": "2026.2.13526",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.3.0",
"lessThan": "2026.3.15936",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged."
}
]
}
],
"references": [
{
"url": "https://advisories.octopus.com/post/2026/sa2026-24"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability was found by Nathan Willoughby",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/126xxx/CVE-2026-126236.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "fortinet",
"dateReserved": "2026-11-10T20:09:28.825Z",
"datePublished": "2026-11-11T21:31:36.058Z",
"dateUpdated": "2026-11-11T21:31:36.058Z"
"dateUpdated": "2026-11-12T13:50:26.144Z"
},
"containers": {
"cna": {
@@ -285,7 +285,7 @@
"providerMetadata": {
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet",
"dateUpdated": "2026-11-11T21:31:36.058Z"
"dateUpdated": "2026-11-12T13:50:26.144Z"
},
"problemTypes": [
{
data/2026/126xxx/CVE-2026-126995.json
+191
View File
@@ -0,0 +1,191 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126995",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-12T07:58:58.681Z",
"datePublished": "2026-11-12T13:45:17.767Z",
"dateUpdated": "2026-11-12T13:45:17.767Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-12T13:45:17.767Z"
},
"title": "tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-22",
"lang": "en",
"description": "Path Traversal"
}
]
}
],
"affected": [
{
"vendor": "tjake",
"product": "Jlama",
"versions": [
{
"version": "0.8.0",
"status": "affected"
},
{
"version": "0.8.1",
"status": "affected"
},
{
"version": "0.8.2",
"status": "affected"
},
{
"version": "0.8.3",
"status": "affected"
},
{
"version": "0.8.4",
"status": "affected"
},
{
"version": "0.9.0-beta",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:a:tjake:jlama:*:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 6.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 6.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-12T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-12T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-12T09:04:03.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "Dem00000 (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/436294",
"name": "VDB-436294 | tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/436294/cti",
"name": "VDB-436294 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-126995",
"name": "CVE-2026-126995 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1040636",
"name": "Submit #1040636 | tjake Jlama 0.9.0-beta, commit 7b8ba424dd72 Path Traversal",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/tjake/Jlama/issues/211",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/user-attachments/files/33599742/poc.zip",
"tags": [
"exploit"
]
},
{
"url": "https://github.com/tjake/Jlama/",
"tags": [
"product"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/127xxx/CVE-2026-127046.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CIRCL",
"dateReserved": "2026-11-12T12:04:58.364Z",
"datePublished": "2026-11-12T12:05:04.052Z",
"dateUpdated": "2026-11-12T12:08:46.771Z"
"dateUpdated": "2026-11-12T13:49:57.139Z"
},
"containers": {
"cna": {
@@ -330,7 +330,7 @@
"providerMetadata": {
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL",
"dateUpdated": "2026-11-12T12:08:46.771Z"
"dateUpdated": "2026-11-12T13:49:57.139Z"
}
}
}
data/2026/13xxx/CVE-2026-13312.json
+3 -3
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Axis",
"dateReserved": "2026-06-25T04:48:32.603Z",
"datePublished": "2026-11-10T05:45:51.816Z",
"dateUpdated": "2026-11-10T05:45:51.816Z"
"dateUpdated": "2026-11-12T14:01:16.002Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807",
"shortName": "Axis",
"dateUpdated": "2026-11-10T05:45:51.816Z"
"dateUpdated": "2026-11-12T14:01:16.002Z"
},
"problemTypes": [
{
@@ -72,7 +72,7 @@
],
"references": [
{
"url": "https://www.axis.com/dam/public/e4/2d/85/cve-2026-13312pdf-en-US-561251.pdf"
"url": "https://www.axis.com/dam/public/permalink/289342/cve-2026-13312pdf-en-US_289342.pdf"
}
],
"metrics": [
data/2026/15xxx/CVE-2026-15554.json
+13 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-13T04:54:33.612Z",
"datePublished": "2026-08-11T08:49:40.484Z",
"dateUpdated": "2026-11-01T00:11:29.115Z"
"dateUpdated": "2026-11-12T14:08:30.966Z"
},
"containers": {
"cna": {
@@ -53,7 +53,6 @@
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"packageName": "undertow-core",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
]
@@ -379,7 +378,7 @@
}
],
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1"
]
},
{
@@ -2596,6 +2595,16 @@
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "undertow-core",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
@@ -2707,7 +2716,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-01T00:11:29.115Z"
"dateUpdated": "2026-11-12T14:08:30.966Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/71xxx/CVE-2026-71367.json
+141
View File
@@ -0,0 +1,141 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-71367",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-08-06T04:27:34.372Z",
"datePublished": "2026-11-12T14:05:21.077Z",
"dateUpdated": "2026-11-12T14:05:21.077Z"
},
"containers": {
"cna": {
"title": "Awx: websocket broadcast groups leak cross-organization job metadata",
"metrics": [
{
"other": {
"content": {
"value": "Moderate",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/controller-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "automation-controller",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-71367",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511903",
"name": "RHBZ#2511903",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-12T13:23:27.792Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-863: Incorrect Authorization",
"workarounds": [
{
"lang": "en",
"value": "There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure:\n\n1. In multi-organization deployments, restrict user account creation to necessary personnel and audit user organization memberships.\n2. If a reverse proxy or load balancer is in front of the Controller, consider restricting WebSocket upgrade requests (/websocket/) to authenticated sessions with known legitimate use cases.\n3. For managed service deployments, engage the managed services team to assess whether additional network-level WebSocket filtering can be applied at the service mesh layer.\n4. Monitor WebSocket subscription activity for users subscribing to broadcast groups outside their organization scope."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-06T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-12T13:23:27.792Z",
"value": "Made public."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T14:05:21.077Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/91xxx/CVE-2026-91150.json
+29 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T20:36:53.441Z",
"datePublished": "2026-11-11T18:38:12.565Z",
"dateUpdated": "2026-11-12T12:53:25.555Z"
"dateUpdated": "2026-11-12T13:32:07.208Z"
},
"containers": {
"cna": {
@@ -122,6 +122,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4.1-1.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
@@ -172,6 +191,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99601",
"name": "RHSA-2026:99601",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99602",
"name": "RHSA-2026:99602",
@@ -245,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:53:25.555Z"
"dateUpdated": "2026-11-12T13:32:07.208Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91151.json
+29 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T20:37:18.522Z",
"datePublished": "2026-11-11T19:46:14.718Z",
"dateUpdated": "2026-11-12T12:53:27.125Z"
"dateUpdated": "2026-11-12T13:32:07.225Z"
},
"containers": {
"cna": {
@@ -122,6 +122,25 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4.1-1.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.8::appstream",
"cpe:/o:redhat:rhel_eus:9.8::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
@@ -172,6 +191,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99601",
"name": "RHSA-2026:99601",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99602",
"name": "RHSA-2026:99602",
@@ -245,7 +272,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T12:53:27.125Z"
"dateUpdated": "2026-11-12T13:32:07.225Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/92xxx/CVE-2026-92083.json
+125
View File
@@ -0,0 +1,125 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-92083",
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"state": "PUBLISHED",
"assignerShortName": "TR-CERT",
"dateReserved": "2026-09-15T13:13:33.083Z",
"datePublished": "2026-11-12T13:42:27.369Z",
"dateUpdated": "2026-11-12T13:42:27.369Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT",
"dateUpdated": "2026-11-12T13:42:27.369Z"
},
"title": "Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer",
"datePublic": "2026-11-12T13:40:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"affected": [
{
"vendor": "TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü",
"product": "pardus-image-writer",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.9.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation.\n\nThis issue affects pardus-image-writer: before 0.9.0.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation.<p>This issue affects pardus-image-writer: before 0.9.0.</p>"
}
]
}
],
"references": [
{
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1532",
"tags": [
"government-resource"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"credits": [
{
"lang": "en",
"value": "Utku Ceylan",
"type": "finder"
}
],
"source": {
"defect": [
"TR-26-1532"
],
"advisory": "TR-26-1532",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/delta.json
+80 -32
View File
@@ -1,50 +1,98 @@
{
"fetchTime": "2026-11-12T13:17:14.904Z",
"numberOfChanges": 7,
"fetchTime": "2026-11-12T14:14:33.753Z",
"numberOfChanges": 15,
"new": [
{
"cveId": "CVE-2026-114466",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114466",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114466.json",
"dateUpdated": "2026-11-12T13:13:00.071Z"
"cveId": "CVE-2026-120490",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120490",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120490.json",
"dateUpdated": "2026-11-12T14:01:48.152Z"
},
{
"cveId": "CVE-2026-114467",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114467",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114467.json",
"dateUpdated": "2026-11-12T13:13:05.067Z"
"cveId": "CVE-2026-120869",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120869",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120869.json",
"dateUpdated": "2026-11-12T14:03:14.594Z"
},
{
"cveId": "CVE-2026-114469",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114469",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114469.json",
"dateUpdated": "2026-11-12T13:12:55.269Z"
"cveId": "CVE-2026-123039",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123039",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123039.json",
"dateUpdated": "2026-11-12T14:02:13.665Z"
},
{
"cveId": "CVE-2026-127058",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127058",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127058.json",
"dateUpdated": "2026-11-12T13:09:59.086Z"
},
{
"cveId": "CVE-2026-97845",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97845",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97845.json",
"dateUpdated": "2026-11-12T13:08:43.473Z"
"cveId": "CVE-2026-71367",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-71367",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71367.json",
"dateUpdated": "2026-11-12T14:05:21.077Z"
}
],
"updated": [
{
"cveId": "CVE-2026-123584",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123584",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123584.json",
"dateUpdated": "2026-11-12T13:14:32.200Z"
"cveId": "CVE-2026-100229",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100229",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100229.json",
"dateUpdated": "2026-11-12T14:02:33.097Z"
},
{
"cveId": "CVE-2026-126642",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126642",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126642.json",
"dateUpdated": "2026-11-12T13:14:11.204Z"
"cveId": "CVE-2026-123523",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123523",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123523.json",
"dateUpdated": "2026-11-12T14:03:34.788Z"
},
{
"cveId": "CVE-2026-123527",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123527",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123527.json",
"dateUpdated": "2026-11-12T14:04:40.567Z"
},
{
"cveId": "CVE-2026-123531",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123531",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123531.json",
"dateUpdated": "2026-11-12T14:06:05.424Z"
},
{
"cveId": "CVE-2026-123535",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123535",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123535.json",
"dateUpdated": "2026-11-12T14:06:57.116Z"
},
{
"cveId": "CVE-2026-123539",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123539",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123539.json",
"dateUpdated": "2026-11-12T14:07:56.763Z"
},
{
"cveId": "CVE-2026-123543",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123543",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123543.json",
"dateUpdated": "2026-11-12T14:08:49.224Z"
},
{
"cveId": "CVE-2026-124485",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124485",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124485.json",
"dateUpdated": "2026-11-12T14:07:37.412Z"
},
{
"cveId": "CVE-2026-124489",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124489",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124489.json",
"dateUpdated": "2026-11-12T14:09:00.349Z"
},
{
"cveId": "CVE-2026-124493",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124493",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124493.json",
"dateUpdated": "2026-11-12T14:12:42.900Z"
},
{
"cveId": "CVE-2026-15554",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15554",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15554.json",
"dateUpdated": "2026-11-12T14:08:30.966Z"
}
],
"error": []
data/deltaLog.json
+395 -1149
View File
File diff suppressed because it is too large. Load diff
state/sync.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"source": "https://github.com/CVEProject/cvelistV5.git",
"upstream_commit": "2fe9d662777d8753581d17cf8666fcda3bb9218d",
"upstream_commit": "b831d6a43ebb3a22ce249044528b84f902e71350",
"since_year": 2017,
"records": 331540,
"synced_at_utc": "2026-11-12T13:25:56.885109+00:00"
"records": 331551,
"synced_at_utc": "2026-11-12T14:24:33.910482+00:00"
}