CVE sync 2026-11-12T13:31:22Z
This commit is contained in:
Vulnerability Bot committed
1 parent
56ee118869
commit
3ee83e37cf
59 files changed
+4261
-1223
No files matched your search
@@ -0,0 +1,151 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110951",
|
||||
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "TR-CERT",
|
||||
"dateReserved": "2026-10-15T09:08:11.013Z",
|
||||
"datePublished": "2026-11-12T12:27:15.893Z",
|
||||
"dateUpdated": "2026-11-12T12:29:46.042Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
|
||||
"shortName": "TR-CERT",
|
||||
"dateUpdated": "2026-11-12T12:29:46.042Z"
|
||||
},
|
||||
"title": "Password Reset via Unverified Email Leading to Account Takeover in Hyper Technology's Hyper E-Commerce Infrastructure",
|
||||
"datePublic": "2026-11-12T11:51:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-640",
|
||||
"description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-50",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-50 Password Recovery Exploitation"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Hyper Teknoloji Ltd. Şti.",
|
||||
"product": "Hyper E-Commerce Infrastructure",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "1.1",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Hyper Teknoloji Ltd. Şti.",
|
||||
"product": "Hyper E-Commerce Infrastructure - dealer integration",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "1.2",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Hyper Teknoloji Ltd. Şti.",
|
||||
"product": "Hyper E-Commerce Infrastructure - Storefront application and management panel",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "2.1796",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation.<p>This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531",
|
||||
"tags": [
|
||||
"government-resource"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Berk Erenmemiş",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"TR-26-1531"
|
||||
],
|
||||
"advisory": "TR-26-1531",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,151 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-111552",
|
||||
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "TR-CERT",
|
||||
"dateReserved": "2026-10-16T11:03:56.297Z",
|
||||
"datePublished": "2026-11-12T12:33:57.269Z",
|
||||
"dateUpdated": "2026-11-12T12:33:57.269Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
|
||||
"shortName": "TR-CERT",
|
||||
"dateUpdated": "2026-11-12T12:33:57.269Z"
|
||||
},
|
||||
"title": "Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure",
|
||||
"datePublic": "2026-11-12T12:30:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-308",
|
||||
"description": "CWE-308 Use of single-factor authentication",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-115",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-115 Authentication Bypass"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Hyper Teknoloji Ltd. Şti.",
|
||||
"product": "Hyper E-Commerce Infrastructure",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "1.1",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Hyper Teknoloji Ltd. Şti.",
|
||||
"product": "Hyper E-Commerce Infrastructure - dealer integration",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "1.2",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Hyper Teknoloji Ltd. Şti.",
|
||||
"product": "Hyper E-Commerce Infrastructure - Storefront application and management panel",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "2.1796",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass.<p>This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531",
|
||||
"tags": [
|
||||
"government-resource"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Berk Erenmemiş",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"TR-26-1531"
|
||||
],
|
||||
"advisory": "TR-26-1531",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:23:32.344Z",
|
||||
"datePublished": "2026-11-09T19:08:29.276Z",
|
||||
"dateUpdated": "2026-11-09T19:57:11.253Z"
|
||||
"dateUpdated": "2026-11-12T12:58:32.022Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112314",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:08:29.276Z"
|
||||
"dateUpdated": "2026-11-12T12:58:32.022Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:23:58.679Z",
|
||||
"datePublished": "2026-11-09T19:07:47.557Z",
|
||||
"dateUpdated": "2026-11-09T19:07:47.557Z"
|
||||
"dateUpdated": "2026-11-12T12:56:51.910Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112315",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:07:47.557Z"
|
||||
"dateUpdated": "2026-11-12T12:56:51.910Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:24:50.360Z",
|
||||
"datePublished": "2026-11-09T19:08:00.263Z",
|
||||
"dateUpdated": "2026-11-09T23:01:38.456Z"
|
||||
"dateUpdated": "2026-11-12T12:56:53.760Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112316",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:08:00.263Z"
|
||||
"dateUpdated": "2026-11-12T12:56:53.760Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:25:20.662Z",
|
||||
"datePublished": "2026-11-09T19:07:58.372Z",
|
||||
"dateUpdated": "2026-11-09T19:07:58.372Z"
|
||||
"dateUpdated": "2026-11-12T12:56:55.968Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112317",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:07:58.372Z"
|
||||
"dateUpdated": "2026-11-12T12:56:55.968Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:25:59.007Z",
|
||||
"datePublished": "2026-11-09T19:08:02.661Z",
|
||||
"dateUpdated": "2026-11-09T19:08:02.661Z"
|
||||
"dateUpdated": "2026-11-12T12:56:57.981Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112318",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:08:02.661Z"
|
||||
"dateUpdated": "2026-11-12T12:56:57.981Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:26:25.093Z",
|
||||
"datePublished": "2026-11-09T19:08:05.007Z",
|
||||
"dateUpdated": "2026-11-09T19:35:07.440Z"
|
||||
"dateUpdated": "2026-11-12T12:57:02.764Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112319",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:08:05.007Z"
|
||||
"dateUpdated": "2026-11-12T12:57:02.764Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:26:51.377Z",
|
||||
"datePublished": "2026-11-09T19:08:07.434Z",
|
||||
"dateUpdated": "2026-11-09T19:08:07.434Z"
|
||||
"dateUpdated": "2026-11-12T12:57:03.261Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112320",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:08:07.434Z"
|
||||
"dateUpdated": "2026-11-12T12:57:03.261Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:27:17.372Z",
|
||||
"datePublished": "2026-11-09T19:08:10.347Z",
|
||||
"dateUpdated": "2026-11-09T23:02:20.841Z"
|
||||
"dateUpdated": "2026-11-12T12:57:05.412Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112321",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T19:08:10.347Z"
|
||||
"dateUpdated": "2026-11-12T12:57:05.412Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:27:47.648Z",
|
||||
"datePublished": "2026-11-09T18:43:23.841Z",
|
||||
"dateUpdated": "2026-11-09T23:00:06.406Z"
|
||||
"dateUpdated": "2026-11-12T12:57:03.732Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112322",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T18:43:23.841Z"
|
||||
"dateUpdated": "2026-11-12T12:57:03.732Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-19T14:29:07.369Z",
|
||||
"datePublished": "2026-11-09T18:43:29.636Z",
|
||||
"dateUpdated": "2026-11-09T18:43:29.636Z"
|
||||
"dateUpdated": "2026-11-12T12:57:08.404Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-112323",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T18:43:29.636Z"
|
||||
"dateUpdated": "2026-11-12T12:57:08.404Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -0,0 +1,122 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-114466",
|
||||
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitLab",
|
||||
"dateReserved": "2026-10-21T15:02:45.478Z",
|
||||
"datePublished": "2026-11-12T13:13:00.071Z",
|
||||
"dateUpdated": "2026-11-12T13:13:00.071Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Insufficient Granularity of Access Control in Git",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Git",
|
||||
"product": "Git",
|
||||
"repo": "https://gitlab.com/git-scm/git",
|
||||
"versions": [
|
||||
{
|
||||
"version": "2.50.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.51.2",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.52.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.53.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.54.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.55.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.56.0",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unknown"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "CWE-1220: Insufficient Granularity of Access Control",
|
||||
"cweId": "CWE-1220",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://gitlab.com/gitlab-org/git/-/work_items/812"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "ehdgks0627, un3xploitable",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"shortName": "GitLab",
|
||||
"dateUpdated": "2026-11-12T13:13:00.071Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,125 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-114467",
|
||||
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitLab",
|
||||
"dateReserved": "2026-10-21T15:02:50.482Z",
|
||||
"datePublished": "2026-11-12T13:13:05.067Z",
|
||||
"dateUpdated": "2026-11-12T13:13:05.067Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Out-of-bounds Write in Git",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Git",
|
||||
"product": "Git",
|
||||
"repo": "https://gitlab.com/git-scm/git",
|
||||
"cpes": [
|
||||
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"version": "2.50.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.51.2",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.52.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.53.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.54.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.55.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.56.0",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unknown"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "CWE-787: Out-of-bounds Write",
|
||||
"cweId": "CWE-787",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://gitlab.com/gitlab-org/git/-/work_items/810"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 3.3,
|
||||
"baseSeverity": "LOW"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "ehdgks0627, un3xploitable",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"shortName": "GitLab",
|
||||
"dateUpdated": "2026-11-12T13:13:05.067Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,122 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-114469",
|
||||
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitLab",
|
||||
"dateReserved": "2026-10-21T15:02:55.490Z",
|
||||
"datePublished": "2026-11-12T13:12:55.269Z",
|
||||
"dateUpdated": "2026-11-12T13:12:55.269Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Out-of-bounds Read in Git",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Git",
|
||||
"product": "Git",
|
||||
"repo": "https://gitlab.com/git-scm/git",
|
||||
"versions": [
|
||||
{
|
||||
"version": "2.50.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.51.2",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.52.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.53.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.54.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.55.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.56.0",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unknown"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "CWE-125: Out-of-bounds Read",
|
||||
"cweId": "CWE-125",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://gitlab.com/gitlab-org/git/-/work_items/811"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 4.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "ehdgks0627, un3xploitable",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"shortName": "GitLab",
|
||||
"dateUpdated": "2026-11-12T13:12:55.269Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-29T13:10:23.375Z",
|
||||
"datePublished": "2026-11-09T18:43:39.044Z",
|
||||
"dateUpdated": "2026-11-09T18:43:39.044Z"
|
||||
"dateUpdated": "2026-11-12T12:57:13.364Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,8 +54,16 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "krb5",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:1.21.3-11.el10_3.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
"cpe:/o:redhat:enterprise_linux:10.3"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -110,6 +118,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99624",
|
||||
"name": "RHSA-2026:99624",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-119079",
|
||||
"tags": [
|
||||
@@ -167,7 +183,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T18:43:39.044Z"
|
||||
"dateUpdated": "2026-11-12T12:57:13.364Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -0,0 +1,132 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-123139",
|
||||
"assignerOrgId": "9aee7086-24f5-48b4-9428-908ac90b8b54",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Opera",
|
||||
"dateReserved": "2026-11-05T14:21:01.547Z",
|
||||
"datePublished": "2026-11-12T12:22:07.291Z",
|
||||
"dateUpdated": "2026-11-12T12:22:07.291Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9aee7086-24f5-48b4-9428-908ac90b8b54",
|
||||
"shortName": "Opera",
|
||||
"dateUpdated": "2026-11-12T12:22:07.291Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-940",
|
||||
"description": "CWE-940 Improper verification of source of a communication channel",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-36",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-36 Using Unpublished Interfaces or Functionality"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Opera",
|
||||
"product": "Neon",
|
||||
"platforms": [
|
||||
"Windows",
|
||||
"MacOS"
|
||||
],
|
||||
"modules": [
|
||||
"MCP Hub extension"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://security.opera.com/en/improper-verification-of-source-of-a-communication-channel-opera-security-advisories/"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "PASSIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "LOW",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "LOW",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "UNREPORTED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.8,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U"
|
||||
}
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "maitai",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:45:39.025Z",
|
||||
"datePublished": "2026-11-08T01:37:14.269Z",
|
||||
"dateUpdated": "2026-11-08T01:37:14.269Z"
|
||||
"dateUpdated": "2026-11-12T12:09:11.966Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -133,6 +133,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:01:50.971303Z",
|
||||
"id": "CVE-2026-123496",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:09:11.966Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:45:39.026Z",
|
||||
"datePublished": "2026-11-08T01:37:16.987Z",
|
||||
"dateUpdated": "2026-11-08T01:37:16.987Z"
|
||||
"dateUpdated": "2026-11-12T12:17:18.037Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -140,6 +140,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:10:53.314099Z",
|
||||
"id": "CVE-2026-123500",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:17:18.037Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:45:39.026Z",
|
||||
"datePublished": "2026-11-08T01:37:19.759Z",
|
||||
"dateUpdated": "2026-11-08T01:37:19.759Z"
|
||||
"dateUpdated": "2026-11-12T12:19:23.734Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -134,6 +134,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:19:03.007200Z",
|
||||
"id": "CVE-2026-123504",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:19:23.734Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:46:28.480Z",
|
||||
"datePublished": "2026-11-08T01:37:22.496Z",
|
||||
"dateUpdated": "2026-11-08T01:37:22.496Z"
|
||||
"dateUpdated": "2026-11-12T12:20:41.762Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -133,6 +133,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:20:18.777965Z",
|
||||
"id": "CVE-2026-123508",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:20:41.762Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:46:28.480Z",
|
||||
"datePublished": "2026-11-08T01:37:25.205Z",
|
||||
"dateUpdated": "2026-11-08T01:37:25.205Z"
|
||||
"dateUpdated": "2026-11-12T12:21:38.415Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -133,6 +133,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:21:25.785994Z",
|
||||
"id": "CVE-2026-123512",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:21:38.415Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:47:14.649Z",
|
||||
"datePublished": "2026-11-08T01:37:28.063Z",
|
||||
"dateUpdated": "2026-11-08T01:37:28.063Z"
|
||||
"dateUpdated": "2026-11-12T12:32:15.609Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -140,6 +140,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:28:33.141176Z",
|
||||
"id": "CVE-2026-123516",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:32:15.609Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:47:14.649Z",
|
||||
"datePublished": "2026-11-08T01:37:31.078Z",
|
||||
"dateUpdated": "2026-11-08T01:37:31.078Z"
|
||||
"dateUpdated": "2026-11-12T12:35:04.512Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -146,6 +146,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:32:46.919757Z",
|
||||
"id": "CVE-2026-123520",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:35:04.512Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:47:14.650Z",
|
||||
"datePublished": "2026-11-08T01:37:34.226Z",
|
||||
"dateUpdated": "2026-11-08T01:37:34.226Z"
|
||||
"dateUpdated": "2026-11-12T12:38:23.426Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -141,6 +141,48 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-66cq-j6rw-pjch",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:36:29.006074Z",
|
||||
"id": "CVE-2026-123524",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "poc"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:38:23.426Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:48:01.382Z",
|
||||
"datePublished": "2026-11-08T01:37:40.982Z",
|
||||
"dateUpdated": "2026-11-08T01:37:40.982Z"
|
||||
"dateUpdated": "2026-11-12T12:44:47.300Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -145,6 +145,48 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-xw69-xv93-5fjv",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:41:13.560830Z",
|
||||
"id": "CVE-2026-123532",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "poc"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:44:47.300Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:48:46.279Z",
|
||||
"datePublished": "2026-11-08T01:37:43.836Z",
|
||||
"dateUpdated": "2026-11-08T01:37:43.836Z"
|
||||
"dateUpdated": "2026-11-12T12:50:04.334Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -155,6 +155,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:46:15.486866Z",
|
||||
"id": "CVE-2026-123536",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:50:04.334Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:48:46.279Z",
|
||||
"datePublished": "2026-11-08T01:37:46.615Z",
|
||||
"dateUpdated": "2026-11-08T01:37:46.615Z"
|
||||
"dateUpdated": "2026-11-12T12:52:06.326Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -155,6 +155,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:51:17.655557Z",
|
||||
"id": "CVE-2026-123540",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:52:06.326Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:48:46.280Z",
|
||||
"datePublished": "2026-11-08T01:37:50.045Z",
|
||||
"dateUpdated": "2026-11-08T01:37:50.045Z"
|
||||
"dateUpdated": "2026-11-12T12:53:17.928Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -228,6 +228,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:52:59.072310Z",
|
||||
"id": "CVE-2026-123544",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:53:17.928Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:49:30.576Z",
|
||||
"datePublished": "2026-11-08T01:37:52.819Z",
|
||||
"dateUpdated": "2026-11-08T01:37:52.819Z"
|
||||
"dateUpdated": "2026-11-12T12:54:22.987Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -189,6 +189,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:53:35.968589Z",
|
||||
"id": "CVE-2026-123548",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:54:22.987Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:49:30.576Z",
|
||||
"datePublished": "2026-11-08T01:37:55.523Z",
|
||||
"dateUpdated": "2026-11-08T01:37:55.523Z"
|
||||
"dateUpdated": "2026-11-12T12:56:09.609Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -150,6 +150,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:55:48.528637Z",
|
||||
"id": "CVE-2026-123552",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:56:09.609Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:50:45.483Z",
|
||||
"datePublished": "2026-11-08T01:37:58.283Z",
|
||||
"dateUpdated": "2026-11-08T01:37:58.283Z"
|
||||
"dateUpdated": "2026-11-12T12:57:04.693Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -151,6 +151,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:56:50.326321Z",
|
||||
"id": "CVE-2026-123556",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:57:04.693Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:50:45.483Z",
|
||||
"datePublished": "2026-11-08T01:38:01.040Z",
|
||||
"dateUpdated": "2026-11-08T01:38:01.040Z"
|
||||
"dateUpdated": "2026-11-12T12:59:51.619Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -150,6 +150,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T12:58:05.934171Z",
|
||||
"id": "CVE-2026-123560",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T12:59:51.619Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:50:45.483Z",
|
||||
"datePublished": "2026-11-08T01:38:03.802Z",
|
||||
"dateUpdated": "2026-11-08T01:38:03.802Z"
|
||||
"dateUpdated": "2026-11-12T13:02:42.004Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -148,6 +148,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T13:02:04.902891Z",
|
||||
"id": "CVE-2026-123564",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T13:02:42.004Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:53:14.312Z",
|
||||
"datePublished": "2026-11-08T01:38:06.526Z",
|
||||
"dateUpdated": "2026-11-08T01:38:06.526Z"
|
||||
"dateUpdated": "2026-11-12T13:03:37.545Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -140,6 +140,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T13:03:03.428600Z",
|
||||
"id": "CVE-2026-123568",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T13:03:37.545Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:55:55.660Z",
|
||||
"datePublished": "2026-11-08T01:38:11.970Z",
|
||||
"dateUpdated": "2026-11-08T01:38:11.970Z"
|
||||
"dateUpdated": "2026-11-12T13:05:36.949Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -125,6 +125,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T13:04:12.113455Z",
|
||||
"id": "CVE-2026-123576",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T13:05:36.949Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:55:55.661Z",
|
||||
"datePublished": "2026-11-08T01:38:14.779Z",
|
||||
"dateUpdated": "2026-11-08T01:38:14.779Z"
|
||||
"dateUpdated": "2026-11-12T13:08:17.209Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -137,6 +137,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T13:07:24.535038Z",
|
||||
"id": "CVE-2026-123580",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T13:08:17.209Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T00:55:55.661Z",
|
||||
"datePublished": "2026-11-08T01:38:17.587Z",
|
||||
"dateUpdated": "2026-11-08T01:38:17.587Z"
|
||||
"dateUpdated": "2026-11-12T13:14:32.200Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -123,6 +123,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T13:13:27.750747Z",
|
||||
"id": "CVE-2026-123584",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T13:14:32.200Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,110 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-125285",
|
||||
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "tibco",
|
||||
"dateReserved": "2026-11-09T18:49:48.747Z",
|
||||
"datePublished": "2026-11-12T12:56:27.620Z",
|
||||
"dateUpdated": "2026-11-12T12:56:27.620Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
|
||||
"shortName": "tibco",
|
||||
"dateUpdated": "2026-11-12T12:56:27.620Z"
|
||||
},
|
||||
"title": "TIBCO Platform’s Self-Hosted Control Plane - Authentication Bypass Vulnerability",
|
||||
"datePublic": "2026-11-12T12:15:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-288",
|
||||
"description": "CWE-288 Authentication bypass using an alternate path or channel",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "TIBCO",
|
||||
"product": "TIBCO Platform’s Self-Hosted Control Plane",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1",
|
||||
"lessThanOrEqual": "1.21",
|
||||
"versionType": "Patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "affected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane.\n\nThis issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane.<p>This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://community.tibco.com/advisories/tibco-security-advisory-november-12-2026-tibco-platform-cve-2026-125285-r232/"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,160 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-125870",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-10T12:49:12.435Z",
|
||||
"datePublished": "2026-11-12T12:48:05.387Z",
|
||||
"dateUpdated": "2026-11-12T12:49:16.026Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T12:49:16.026Z"
|
||||
},
|
||||
"title": "BookStack before 26.09.3 Broken Access Control via ImageController",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored."
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"datePublic": "2026-11-12T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect Authorization",
|
||||
"cweId": "CWE-863",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "bookstackapp",
|
||||
"product": "bookstack",
|
||||
"packageURL": "pkg:github/bookstackapp/bookstack",
|
||||
"repo": "https://github.com/bookstackapp/bookstack",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "custom",
|
||||
"lessThan": "26.09.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "LOW",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "LOW",
|
||||
"baseScore": 2.3,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 4.2,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3",
|
||||
"name": "Vendor Patch (Codeberg)",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3",
|
||||
"name": "Vendor Patch (GitHub)",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/",
|
||||
"name": "Vendor Advisory",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/bookstack-before-broken-access-control-via-imagecontroller",
|
||||
"name": "VulnCheck Advisory: BookStack before 26.09.3 Broken Access Control via ImageController",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CayCon",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "fortinet",
|
||||
"dateReserved": "2026-11-10T20:10:03.791Z",
|
||||
"datePublished": "2026-11-11T21:31:52.364Z",
|
||||
"dateUpdated": "2026-11-11T21:31:52.364Z"
|
||||
"dateUpdated": "2026-11-12T13:03:36.420Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -17,65 +17,10 @@
|
||||
"vendor": "Fortinet",
|
||||
"product": "FortiOS",
|
||||
"cpes": [
|
||||
"cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.4.13:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.14:*:*:*:*:*:*:*"
|
||||
"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"
|
||||
],
|
||||
"defaultStatus": "unaffected",
|
||||
"versions": [
|
||||
@@ -94,19 +39,13 @@
|
||||
{
|
||||
"versionType": "semver",
|
||||
"version": "7.4.0",
|
||||
"lessThanOrEqual": "7.4.13",
|
||||
"lessThanOrEqual": "7.4.12",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"versionType": "semver",
|
||||
"version": "7.2.0",
|
||||
"lessThanOrEqual": "7.2.14",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"versionType": "semver",
|
||||
"version": "7.0.0",
|
||||
"lessThanOrEqual": "7.0.19",
|
||||
"lessThanOrEqual": "7.2.13",
|
||||
"status": "affected"
|
||||
}
|
||||
]
|
||||
@@ -115,13 +54,13 @@
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets."
|
||||
"value": "A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
|
||||
"shortName": "fortinet",
|
||||
"dateUpdated": "2026-11-11T21:31:52.364Z"
|
||||
"dateUpdated": "2026-11-12T13:03:36.420Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
@@ -157,7 +96,7 @@
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above"
|
||||
"value": "Upgrade to 8.0.2 or above\nUpgrade to 7.6.8 or above\nUpgrade to 7.4.13 or above\nUpgrade to 7.2.14 or above"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-11T10:46:47.354Z",
|
||||
"datePublished": "2026-11-12T08:29:21.412Z",
|
||||
"dateUpdated": "2026-11-12T08:29:21.412Z"
|
||||
"dateUpdated": "2026-11-12T13:14:11.204Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -148,10 +148,16 @@
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Red Hat would like to thank Seungwon Kim (0xRrudy) for reporting this issue."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T08:29:21.412Z"
|
||||
"dateUpdated": "2026-11-12T13:14:11.204Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -0,0 +1,171 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126993",
|
||||
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulDB",
|
||||
"dateReserved": "2026-11-12T07:52:29.790Z",
|
||||
"datePublished": "2026-11-12T12:15:18.703Z",
|
||||
"dateUpdated": "2026-11-12T12:15:18.703Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"shortName": "VulDB",
|
||||
"dateUpdated": "2026-11-12T12:15:18.703Z"
|
||||
},
|
||||
"title": "SiteServer SSCMS captcha inadequate encryption",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-326",
|
||||
"lang": "en",
|
||||
"description": "Inadequate Encryption Strength"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-310",
|
||||
"lang": "en",
|
||||
"description": "Cryptographic Issues"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "SiteServer",
|
||||
"product": "SSCMS",
|
||||
"versions": [
|
||||
{
|
||||
"version": "7.2.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "7.2.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "7.2.2",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:sscms:sscms:*:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"baseScore": 6.9,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_0": {
|
||||
"version": "3.0",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV2_0": {
|
||||
"version": "2.0",
|
||||
"baseScore": 4.3,
|
||||
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C"
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-11-12T00:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Advisory disclosed"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-12T01:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry created"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-12T08:57:34.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry last update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "ssss-s (VulDB User)",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB CNA Team",
|
||||
"type": "coordinator"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/436288",
|
||||
"name": "VDB-436288 | SiteServer SSCMS captcha inadequate encryption",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/436288/cti",
|
||||
"name": "VDB-436288 | CTI Indicators (IOB, IOC, TTP, IOA)",
|
||||
"tags": [
|
||||
"signature",
|
||||
"permissions-required"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/cve/CVE-2026-126993",
|
||||
"name": "CVE-2026-126993 | CVE Analysis and Report",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/submit/1040543",
|
||||
"name": "Submit #1040543 | SSCMS 7.2.2 | Weak key derivation / cryptographic token forgery / SSTI",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_generator": [
|
||||
"VulDB PVTS v202611"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,199 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126994",
|
||||
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulDB",
|
||||
"dateReserved": "2026-11-12T07:57:21.265Z",
|
||||
"datePublished": "2026-11-12T12:30:27.079Z",
|
||||
"dateUpdated": "2026-11-12T12:30:27.079Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"shortName": "VulDB",
|
||||
"dateUpdated": "2026-11-12T12:30:27.079Z"
|
||||
},
|
||||
"title": "braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-470",
|
||||
"lang": "en",
|
||||
"description": "Use of Externally-Controlled Input to Select Classes or Code"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "n/a",
|
||||
"product": "braindecode",
|
||||
"versions": [
|
||||
{
|
||||
"version": "1.8.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "1.8.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.0.0",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:braindecode:braindecode:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"modules": [
|
||||
"Model Config Deserialization"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_0": {
|
||||
"version": "3.0",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV2_0": {
|
||||
"version": "2.0",
|
||||
"baseScore": 7.5,
|
||||
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-11-12T00:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Advisory disclosed"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-12T01:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry created"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-12T09:02:26.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry last update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Dem00000 (VulDB User)",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/436293",
|
||||
"name": "VDB-436293 | braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/436293/cti",
|
||||
"name": "VDB-436293 | CTI Indicators (IOB, IOC, IOA)",
|
||||
"tags": [
|
||||
"signature",
|
||||
"permissions-required"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/cve/CVE-2026-126994",
|
||||
"name": "CVE-2026-126994 | CVE Analysis and Report",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/submit/1040635",
|
||||
"name": "Submit #1040635 | braindecode 1.4.0 to 1.8.1 (commit adaa63a8ac7510d0976ee134f6a9ff8e916ef37d) Unsafe Reflection",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/braindecode/braindecode/issues/1441",
|
||||
"tags": [
|
||||
"issue-tracking"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/braindecode/braindecode/pull/1494",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/user-attachments/files/33599402/poc.zip",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/braindecode/braindecode/releases/tag/v2.0.0",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/braindecode/braindecode/",
|
||||
"tags": [
|
||||
"product"
|
||||
]
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"x_generator": [
|
||||
"VulDB PVTS v202611"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,16 +8,16 @@
|
||||
"assignerShortName": "tibco",
|
||||
"dateReserved": "2026-11-12T11:10:34.166Z",
|
||||
"datePublished": "2026-11-12T11:34:16.443Z",
|
||||
"dateUpdated": "2026-11-12T11:34:16.443Z"
|
||||
"dateUpdated": "2026-11-12T12:09:55.650Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
|
||||
"shortName": "tibco",
|
||||
"dateUpdated": "2026-11-12T11:34:16.443Z"
|
||||
"dateUpdated": "2026-11-12T12:09:55.650Z"
|
||||
},
|
||||
"title": "ibi WebFOCUS - Reflected XSS & OS Command Injection Vulnerability",
|
||||
"title": "ibi WebFOCUS - OS Command Injection Vulnerability",
|
||||
"datePublic": "2026-11-12T11:30:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
|
||||
@@ -0,0 +1,145 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-127050",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T12:23:32.735Z",
|
||||
"datePublished": "2026-11-12T12:25:41.651Z",
|
||||
"dateUpdated": "2026-11-12T12:25:41.651Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T12:25:41.651Z"
|
||||
},
|
||||
"title": "Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing \"..\" sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution."
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"datePublic": "2026-11-12T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
||||
"cweId": "CWE-22",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "inisev",
|
||||
"product": "Backup Migration",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThan": "2.1.8"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "ACTIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.1,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://wordpress.org/plugins/backup-backup/#developers",
|
||||
"name": "Vendor Patch",
|
||||
"tags": [
|
||||
"patch",
|
||||
"release-notes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/backup-migration-before-path-traversal-via-pclzip-restore-fallback",
|
||||
"name": "VulnCheck Advisory: Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Yll Berisha",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-127056",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T12:36:45.834Z",
|
||||
"datePublished": "2026-11-12T12:39:13.552Z",
|
||||
"dateUpdated": "2026-11-12T12:39:13.552Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T12:39:13.552Z"
|
||||
},
|
||||
"title": "PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab."
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"datePublic": "2026-11-12T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Inefficient Algorithmic Complexity",
|
||||
"cweId": "CWE-407",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "mholt",
|
||||
"product": "PapaParse",
|
||||
"packageURL": "pkg:npm/papaparse",
|
||||
"repo": "https://github.com/mholt/PapaParse",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThan": "5.7.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.7,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.npmjs.com/package/papaparse",
|
||||
"name": "Vendor Patch",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/mholt/PapaParse/commit/a50fe19aae08b966de444119333fe4a8b7aa6b2f",
|
||||
"tags": [
|
||||
"issue-tracking"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/papaparse-before-quadratic-time-parsing-dos-via-indexof-scan",
|
||||
"name": "VulnCheck Advisory: PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Muhammadyusuf Dilmurodov (agrresore)",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,159 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-127058",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T13:05:14.832Z",
|
||||
"datePublished": "2026-11-12T13:09:59.086Z",
|
||||
"dateUpdated": "2026-11-12T13:09:59.086Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T13:09:59.086Z"
|
||||
},
|
||||
"title": "WonderCMS before 3.7.0 Unverified Password Change via saveAction",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account."
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"datePublic": "2026-11-12T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Unverified Password Change",
|
||||
"cweId": "CWE-620",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "WonderCMS",
|
||||
"product": "wondercms",
|
||||
"packageURL": "pkg:github/WonderCMS/wondercms",
|
||||
"repo": "https://github.com/WonderCMS/wondercms",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThan": "3.7.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.9,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 4.9,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/WonderCMS/wondercms/security/advisories/GHSA-qc3r-v7fc-24xc",
|
||||
"name": "Vendor Advisory",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/WonderCMS/wondercms/releases#release-3.7.0",
|
||||
"name": "Vendor Patch",
|
||||
"tags": [
|
||||
"release-notes",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/wondercms-before-unverified-password-change-via-saveaction",
|
||||
"name": "VulnCheck Advisory: WonderCMS before 3.7.0 Unverified Password Change via saveAction",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Harsh Raj Singhania",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "manop55555",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,129 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-19422",
|
||||
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Zohocorp",
|
||||
"dateReserved": "2026-08-10T10:54:36.168Z",
|
||||
"datePublished": "2026-11-12T12:16:50.068Z",
|
||||
"dateUpdated": "2026-11-12T12:16:50.068Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"shortName": "Zohocorp",
|
||||
"dateUpdated": "2026-11-12T12:16:50.068Z"
|
||||
},
|
||||
"title": "Authentication Bypass",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-306",
|
||||
"description": "CWE-306 – Missing Authentication for Critical Function",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-115",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-115 – Authentication Bypass"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "DDI Central",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "6301",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "6301"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>Zohocorp ManageEngine </span>DDI Central<span> versions below </span>6301<span> is affected by </span>an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"baseScore": 9.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,129 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-75864",
|
||||
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Zohocorp",
|
||||
"dateReserved": "2026-08-18T11:08:19.652Z",
|
||||
"datePublished": "2026-11-12T12:21:11.903Z",
|
||||
"dateUpdated": "2026-11-12T12:21:11.903Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"shortName": "Zohocorp",
|
||||
"dateUpdated": "2026-11-12T12:21:11.903Z"
|
||||
},
|
||||
"title": "Broken Access Control",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-862",
|
||||
"description": "CWE-862 – Missing Authorization",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-122",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-122 – Privilege Abuse"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "DDI Central",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "6301",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "6301"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>Zohocorp ManageEngine </span>DDI Central<span> versions below </span>6301<span> is affected by </span>an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75864.html"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,129 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-75867",
|
||||
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Zohocorp",
|
||||
"dateReserved": "2026-08-18T11:54:25.454Z",
|
||||
"datePublished": "2026-11-12T12:26:47.217Z",
|
||||
"dateUpdated": "2026-11-12T12:26:47.217Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"shortName": "Zohocorp",
|
||||
"dateUpdated": "2026-11-12T12:26:47.217Z"
|
||||
},
|
||||
"title": "Broken Access Control",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-863",
|
||||
"description": "CWE-863 – Incorrect Authorization",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-180",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "DDI Central",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "6301",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "6301"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>Zohocorp ManageEngine </span>DDI Central<span> versions below </span>6301<span> is affected by </span>an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75867.html"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,129 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-75868",
|
||||
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Zohocorp",
|
||||
"dateReserved": "2026-08-18T11:54:41.495Z",
|
||||
"datePublished": "2026-11-12T12:30:33.462Z",
|
||||
"dateUpdated": "2026-11-12T12:30:33.462Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"shortName": "Zohocorp",
|
||||
"dateUpdated": "2026-11-12T12:30:33.462Z"
|
||||
},
|
||||
"title": "Broken Access Control",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-863",
|
||||
"description": "CWE-863 – Incorrect Authorization",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-180",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "DDI Central",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "6301",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "6301"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>Zohocorp ManageEngine </span>DDI Central<span> versions below </span>6301<span> is affected by </span>an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75868.html"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,129 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-75869",
|
||||
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Zohocorp",
|
||||
"dateReserved": "2026-08-18T11:56:23.283Z",
|
||||
"datePublished": "2026-11-12T12:40:30.592Z",
|
||||
"dateUpdated": "2026-11-12T12:40:30.592Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"shortName": "Zohocorp",
|
||||
"dateUpdated": "2026-11-12T12:40:30.592Z"
|
||||
},
|
||||
"title": "Authenticated command injection",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-78",
|
||||
"description": "CWE-78 – Improper Neutralization of Special Elements used in an OS Command",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-180",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "DDI Central",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "6301",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "6301"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>Zohocorp ManageEngine </span>DDI Central<span> versions below </span>6301<span> is affected by </span>an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75869.html"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-09-14T20:36:53.441Z",
|
||||
"datePublished": "2026-11-11T18:38:12.565Z",
|
||||
"dateUpdated": "2026-11-12T11:45:09.204Z"
|
||||
"dateUpdated": "2026-11-12T12:53:25.555Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -86,12 +86,21 @@
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 7",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "cockpit",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:366.1.1-1.el9_9",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:7"
|
||||
"cpe:/a:redhat:enterprise_linux:9::appstream",
|
||||
"cpe:/o:redhat:enterprise_linux:9::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -100,8 +109,27 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "cockpit",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:366.1.1-1.el9_9",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:9"
|
||||
"cpe:/a:redhat:enterprise_linux:9::appstream",
|
||||
"cpe:/o:redhat:enterprise_linux:9::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 7",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "cockpit",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:7"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -144,6 +172,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99602",
|
||||
"name": "RHSA-2026:99602",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99603",
|
||||
"name": "RHSA-2026:99603",
|
||||
@@ -209,7 +245,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T11:45:09.204Z"
|
||||
"dateUpdated": "2026-11-12T12:53:25.555Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-09-14T20:37:18.522Z",
|
||||
"datePublished": "2026-11-11T19:46:14.718Z",
|
||||
"dateUpdated": "2026-11-12T11:45:09.245Z"
|
||||
"dateUpdated": "2026-11-12T12:53:27.125Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -86,12 +86,21 @@
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 7",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "cockpit",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:366.1.1-1.el9_9",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:7"
|
||||
"cpe:/a:redhat:enterprise_linux:9::appstream",
|
||||
"cpe:/o:redhat:enterprise_linux:9::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -100,8 +109,27 @@
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "cockpit",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:366.1.1-1.el9_9",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:9"
|
||||
"cpe:/a:redhat:enterprise_linux:9::appstream",
|
||||
"cpe:/o:redhat:enterprise_linux:9::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 7",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "cockpit",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:7"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -144,6 +172,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99602",
|
||||
"name": "RHSA-2026:99602",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99603",
|
||||
"name": "RHSA-2026:99603",
|
||||
@@ -209,7 +245,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T11:45:09.245Z"
|
||||
"dateUpdated": "2026-11-12T12:53:27.125Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -0,0 +1,181 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-97845",
|
||||
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Qt",
|
||||
"dateReserved": "2026-09-25T05:24:04.653Z",
|
||||
"datePublished": "2026-11-12T13:08:43.473Z",
|
||||
"dateUpdated": "2026-11-12T13:08:43.473Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
|
||||
"shortName": "Qt",
|
||||
"dateUpdated": "2026-11-12T13:08:43.473Z"
|
||||
},
|
||||
"title": "Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt",
|
||||
"datePublic": "2026-11-12T13:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-674",
|
||||
"description": "CWE-674 Uncontrolled Recursion",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-230",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-230 Serialized Data with Nested Payloads"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "qt",
|
||||
"product": "qt",
|
||||
"modules": [
|
||||
"qtbase",
|
||||
"qt5compat"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"status": "unknown",
|
||||
"version": "0",
|
||||
"lessThan": "5.0.0",
|
||||
"versionType": "python"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "5.0.0",
|
||||
"lessThan": "6.8.10",
|
||||
"versionType": "python"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "6.9.0",
|
||||
"lessThan": "6.11.3",
|
||||
"versionType": "python"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected",
|
||||
"cpes": [
|
||||
"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>An uncontrolled recursion vulnerability has been discovered in the Qt <code>QXmlSimpleReader</code> XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.qt.io/security-advisories?search=CVE-2026-97845",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/771290",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/774512",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/774513",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/774632",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/760219",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/760220",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "PASSIVE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "UNREPORTED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "USER",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "GREEN",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 4.3,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/U:Green"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+40
-15
@@ -1,26 +1,51 @@
|
||||
{
|
||||
"fetchTime": "2026-11-12T12:08:57.966Z",
|
||||
"numberOfChanges": 3,
|
||||
"fetchTime": "2026-11-12T13:17:14.904Z",
|
||||
"numberOfChanges": 7,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2026-124705",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124705",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124705.json",
|
||||
"dateUpdated": "2026-11-12T11:59:34.996Z"
|
||||
"cveId": "CVE-2026-114466",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114466",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114466.json",
|
||||
"dateUpdated": "2026-11-12T13:13:00.071Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-127046",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127046",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127046.json",
|
||||
"dateUpdated": "2026-11-12T12:08:46.771Z"
|
||||
"cveId": "CVE-2026-114467",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114467",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114467.json",
|
||||
"dateUpdated": "2026-11-12T13:13:05.067Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-19421",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-19421",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19421.json",
|
||||
"dateUpdated": "2026-11-12T12:07:53.861Z"
|
||||
"cveId": "CVE-2026-114469",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114469",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114469.json",
|
||||
"dateUpdated": "2026-11-12T13:12:55.269Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-127058",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127058",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127058.json",
|
||||
"dateUpdated": "2026-11-12T13:09:59.086Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-97845",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97845",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97845.json",
|
||||
"dateUpdated": "2026-11-12T13:08:43.473Z"
|
||||
}
|
||||
],
|
||||
"updated": [
|
||||
{
|
||||
"cveId": "CVE-2026-123584",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123584",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123584.json",
|
||||
"dateUpdated": "2026-11-12T13:14:32.200Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-126642",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126642",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126642.json",
|
||||
"dateUpdated": "2026-11-12T13:14:11.204Z"
|
||||
}
|
||||
],
|
||||
"updated": [],
|
||||
"error": []
|
||||
}
|
||||
+412
-1047
File diff suppressed because it is too large.
Load diff
+3
-3
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"source": "https://github.com/CVEProject/cvelistV5.git",
|
||||
"upstream_commit": "aae981a544f3ef85d76221c38b743ef53c23e8a4",
|
||||
"upstream_commit": "2fe9d662777d8753581d17cf8666fcda3bb9218d",
|
||||
"since_year": 2017,
|
||||
"records": 331521,
|
||||
"synced_at_utc": "2026-11-12T12:28:00.845048+00:00"
|
||||
"records": 331540,
|
||||
"synced_at_utc": "2026-11-12T13:25:56.885109+00:00"
|
||||
}
|
||||
Reference in new issue
Block a user