This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.
" + } + ] + } + ], + "references": [ + { + "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531", + "tags": [ + "government-resource" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 7.5, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Berk Erenmemiş", + "type": "finder" + } + ], + "source": { + "defect": [ + "TR-26-1531" + ], + "advisory": "TR-26-1531", + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/111xxx/CVE-2026-111552.json b/data/2026/111xxx/CVE-2026-111552.json new file mode 100644 index 0000000000..73ea97e479 --- /dev/null +++ b/data/2026/111xxx/CVE-2026-111552.json @@ -0,0 +1,151 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-111552", + "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", + "state": "PUBLISHED", + "assignerShortName": "TR-CERT", + "dateReserved": "2026-10-16T11:03:56.297Z", + "datePublished": "2026-11-12T12:33:57.269Z", + "dateUpdated": "2026-11-12T12:33:57.269Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", + "shortName": "TR-CERT", + "dateUpdated": "2026-11-12T12:33:57.269Z" + }, + "title": "Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure", + "datePublic": "2026-11-12T12:30:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-308", + "description": "CWE-308 Use of single-factor authentication", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-115", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-115 Authentication Bypass" + } + ] + } + ], + "affected": [ + { + "vendor": "Hyper Teknoloji Ltd. Şti.", + "product": "Hyper E-Commerce Infrastructure", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "1.1", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + }, + { + "vendor": "Hyper Teknoloji Ltd. Şti.", + "product": "Hyper E-Commerce Infrastructure - dealer integration", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "1.2", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + }, + { + "vendor": "Hyper Teknoloji Ltd. Şti.", + "product": "Hyper E-Commerce Infrastructure - Storefront application and management panel", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "2.1796", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass.This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.
" + } + ] + } + ], + "references": [ + { + "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531", + "tags": [ + "government-resource" + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseSeverity": "HIGH", + "baseScore": 7.1, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "Berk Erenmemiş", + "type": "finder" + } + ], + "source": { + "defect": [ + "TR-26-1531" + ], + "advisory": "TR-26-1531", + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/112xxx/CVE-2026-112314.json b/data/2026/112xxx/CVE-2026-112314.json index d5eb6ef106..a4627a8c11 100644 --- a/data/2026/112xxx/CVE-2026-112314.json +++ b/data/2026/112xxx/CVE-2026-112314.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:23:32.344Z", "datePublished": "2026-11-09T19:08:29.276Z", - "dateUpdated": "2026-11-09T19:57:11.253Z" + "dateUpdated": "2026-11-12T12:58:32.022Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112314", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:08:29.276Z" + "dateUpdated": "2026-11-12T12:58:32.022Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112315.json b/data/2026/112xxx/CVE-2026-112315.json index be828fcffe..858c1caa0c 100644 --- a/data/2026/112xxx/CVE-2026-112315.json +++ b/data/2026/112xxx/CVE-2026-112315.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:23:58.679Z", "datePublished": "2026-11-09T19:07:47.557Z", - "dateUpdated": "2026-11-09T19:07:47.557Z" + "dateUpdated": "2026-11-12T12:56:51.910Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112315", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:07:47.557Z" + "dateUpdated": "2026-11-12T12:56:51.910Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112316.json b/data/2026/112xxx/CVE-2026-112316.json index 33d25e3782..c7edfc1411 100644 --- a/data/2026/112xxx/CVE-2026-112316.json +++ b/data/2026/112xxx/CVE-2026-112316.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:24:50.360Z", "datePublished": "2026-11-09T19:08:00.263Z", - "dateUpdated": "2026-11-09T23:01:38.456Z" + "dateUpdated": "2026-11-12T12:56:53.760Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112316", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:08:00.263Z" + "dateUpdated": "2026-11-12T12:56:53.760Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112317.json b/data/2026/112xxx/CVE-2026-112317.json index 83dd362cff..2306da0e60 100644 --- a/data/2026/112xxx/CVE-2026-112317.json +++ b/data/2026/112xxx/CVE-2026-112317.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:25:20.662Z", "datePublished": "2026-11-09T19:07:58.372Z", - "dateUpdated": "2026-11-09T19:07:58.372Z" + "dateUpdated": "2026-11-12T12:56:55.968Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112317", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:07:58.372Z" + "dateUpdated": "2026-11-12T12:56:55.968Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112318.json b/data/2026/112xxx/CVE-2026-112318.json index 48b93840d6..58b5b4dc7d 100644 --- a/data/2026/112xxx/CVE-2026-112318.json +++ b/data/2026/112xxx/CVE-2026-112318.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:25:59.007Z", "datePublished": "2026-11-09T19:08:02.661Z", - "dateUpdated": "2026-11-09T19:08:02.661Z" + "dateUpdated": "2026-11-12T12:56:57.981Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112318", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:08:02.661Z" + "dateUpdated": "2026-11-12T12:56:57.981Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112319.json b/data/2026/112xxx/CVE-2026-112319.json index d71a6e42db..6982d5eb07 100644 --- a/data/2026/112xxx/CVE-2026-112319.json +++ b/data/2026/112xxx/CVE-2026-112319.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:26:25.093Z", "datePublished": "2026-11-09T19:08:05.007Z", - "dateUpdated": "2026-11-09T19:35:07.440Z" + "dateUpdated": "2026-11-12T12:57:02.764Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112319", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:08:05.007Z" + "dateUpdated": "2026-11-12T12:57:02.764Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112320.json b/data/2026/112xxx/CVE-2026-112320.json index f14a627940..33a764b9aa 100644 --- a/data/2026/112xxx/CVE-2026-112320.json +++ b/data/2026/112xxx/CVE-2026-112320.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:26:51.377Z", "datePublished": "2026-11-09T19:08:07.434Z", - "dateUpdated": "2026-11-09T19:08:07.434Z" + "dateUpdated": "2026-11-12T12:57:03.261Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112320", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:08:07.434Z" + "dateUpdated": "2026-11-12T12:57:03.261Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112321.json b/data/2026/112xxx/CVE-2026-112321.json index f7736b98f3..dfadbf2f84 100644 --- a/data/2026/112xxx/CVE-2026-112321.json +++ b/data/2026/112xxx/CVE-2026-112321.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:27:17.372Z", "datePublished": "2026-11-09T19:08:10.347Z", - "dateUpdated": "2026-11-09T23:02:20.841Z" + "dateUpdated": "2026-11-12T12:57:05.412Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112321", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T19:08:10.347Z" + "dateUpdated": "2026-11-12T12:57:05.412Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112322.json b/data/2026/112xxx/CVE-2026-112322.json index 2a2d9e346a..301da9bc32 100644 --- a/data/2026/112xxx/CVE-2026-112322.json +++ b/data/2026/112xxx/CVE-2026-112322.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:27:47.648Z", "datePublished": "2026-11-09T18:43:23.841Z", - "dateUpdated": "2026-11-09T23:00:06.406Z" + "dateUpdated": "2026-11-12T12:57:03.732Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112322", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T18:43:23.841Z" + "dateUpdated": "2026-11-12T12:57:03.732Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/112xxx/CVE-2026-112323.json b/data/2026/112xxx/CVE-2026-112323.json index 395e446cca..b6740c3081 100644 --- a/data/2026/112xxx/CVE-2026-112323.json +++ b/data/2026/112xxx/CVE-2026-112323.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:29:07.369Z", "datePublished": "2026-11-09T18:43:29.636Z", - "dateUpdated": "2026-11-09T18:43:29.636Z" + "dateUpdated": "2026-11-12T12:57:08.404Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-112323", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T18:43:29.636Z" + "dateUpdated": "2026-11-12T12:57:08.404Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/114xxx/CVE-2026-114466.json b/data/2026/114xxx/CVE-2026-114466.json new file mode 100644 index 0000000000..2ab994ab57 --- /dev/null +++ b/data/2026/114xxx/CVE-2026-114466.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-114466", + "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "state": "PUBLISHED", + "assignerShortName": "GitLab", + "dateReserved": "2026-10-21T15:02:45.478Z", + "datePublished": "2026-11-12T13:13:00.071Z", + "dateUpdated": "2026-11-12T13:13:00.071Z" + }, + "containers": { + "cna": { + "title": "Insufficient Granularity of Access Control in Git", + "descriptions": [ + { + "lang": "en", + "value": "Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe" + } + ], + "affected": [ + { + "vendor": "Git", + "product": "Git", + "repo": "https://gitlab.com/git-scm/git", + "versions": [ + { + "version": "2.50.1", + "status": "affected" + }, + { + "version": "2.51.2", + "status": "affected" + }, + { + "version": "2.52.0", + "status": "affected" + }, + { + "version": "2.53.0", + "status": "affected" + }, + { + "version": "2.54.0", + "status": "affected" + }, + { + "version": "2.55.0", + "status": "affected" + }, + { + "version": "2.56.0", + "status": "affected" + } + ], + "defaultStatus": "unknown" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-1220: Insufficient Granularity of Access Control", + "cweId": "CWE-1220", + "type": "CWE" + } + ] + } + ], + "references": [ + { + "url": "https://gitlab.com/gitlab-org/git/-/work_items/812" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 4.4, + "baseSeverity": "MEDIUM" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above." + } + ], + "credits": [ + { + "lang": "en", + "value": "ehdgks0627, un3xploitable", + "type": "finder" + } + ], + "providerMetadata": { + "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "shortName": "GitLab", + "dateUpdated": "2026-11-12T13:13:00.071Z" + } + } + } +} \ No newline at end of file diff --git a/data/2026/114xxx/CVE-2026-114467.json b/data/2026/114xxx/CVE-2026-114467.json new file mode 100644 index 0000000000..974d6b6b5f --- /dev/null +++ b/data/2026/114xxx/CVE-2026-114467.json @@ -0,0 +1,125 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-114467", + "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "state": "PUBLISHED", + "assignerShortName": "GitLab", + "dateReserved": "2026-10-21T15:02:50.482Z", + "datePublished": "2026-11-12T13:13:05.067Z", + "dateUpdated": "2026-11-12T13:13:05.067Z" + }, + "containers": { + "cna": { + "title": "Out-of-bounds Write in Git", + "descriptions": [ + { + "lang": "en", + "value": "Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures" + } + ], + "affected": [ + { + "vendor": "Git", + "product": "Git", + "repo": "https://gitlab.com/git-scm/git", + "cpes": [ + "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*" + ], + "versions": [ + { + "version": "2.50.1", + "status": "affected" + }, + { + "version": "2.51.2", + "status": "affected" + }, + { + "version": "2.52.0", + "status": "affected" + }, + { + "version": "2.53.0", + "status": "affected" + }, + { + "version": "2.54.0", + "status": "affected" + }, + { + "version": "2.55.0", + "status": "affected" + }, + { + "version": "2.56.0", + "status": "affected" + } + ], + "defaultStatus": "unknown" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-787: Out-of-bounds Write", + "cweId": "CWE-787", + "type": "CWE" + } + ] + } + ], + "references": [ + { + "url": "https://gitlab.com/gitlab-org/git/-/work_items/810" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "LOW", + "baseScore": 3.3, + "baseSeverity": "LOW" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above." + } + ], + "credits": [ + { + "lang": "en", + "value": "ehdgks0627, un3xploitable", + "type": "finder" + } + ], + "providerMetadata": { + "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "shortName": "GitLab", + "dateUpdated": "2026-11-12T13:13:05.067Z" + } + } + } +} \ No newline at end of file diff --git a/data/2026/114xxx/CVE-2026-114469.json b/data/2026/114xxx/CVE-2026-114469.json new file mode 100644 index 0000000000..c37bb8f338 --- /dev/null +++ b/data/2026/114xxx/CVE-2026-114469.json @@ -0,0 +1,122 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-114469", + "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "state": "PUBLISHED", + "assignerShortName": "GitLab", + "dateReserved": "2026-10-21T15:02:55.490Z", + "datePublished": "2026-11-12T13:12:55.269Z", + "dateUpdated": "2026-11-12T13:12:55.269Z" + }, + "containers": { + "cna": { + "title": "Out-of-bounds Read in Git", + "descriptions": [ + { + "lang": "en", + "value": "Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size" + } + ], + "affected": [ + { + "vendor": "Git", + "product": "Git", + "repo": "https://gitlab.com/git-scm/git", + "versions": [ + { + "version": "2.50.1", + "status": "affected" + }, + { + "version": "2.51.2", + "status": "affected" + }, + { + "version": "2.52.0", + "status": "affected" + }, + { + "version": "2.53.0", + "status": "affected" + }, + { + "version": "2.54.0", + "status": "affected" + }, + { + "version": "2.55.0", + "status": "affected" + }, + { + "version": "2.56.0", + "status": "affected" + } + ], + "defaultStatus": "unknown" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-125: Out-of-bounds Read", + "cweId": "CWE-125", + "type": "CWE" + } + ] + } + ], + "references": [ + { + "url": "https://gitlab.com/gitlab-org/git/-/work_items/811" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "LOW", + "baseScore": 4.4, + "baseSeverity": "MEDIUM" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above." + } + ], + "credits": [ + { + "lang": "en", + "value": "ehdgks0627, un3xploitable", + "type": "finder" + } + ], + "providerMetadata": { + "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", + "shortName": "GitLab", + "dateUpdated": "2026-11-12T13:12:55.269Z" + } + } + } +} \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119079.json b/data/2026/119xxx/CVE-2026-119079.json index 115bd22860..bf3a774570 100644 --- a/data/2026/119xxx/CVE-2026-119079.json +++ b/data/2026/119xxx/CVE-2026-119079.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-29T13:10:23.375Z", "datePublished": "2026-11-09T18:43:39.044Z", - "dateUpdated": "2026-11-09T18:43:39.044Z" + "dateUpdated": "2026-11-12T12:57:13.364Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.21.3-11.el10_3.2", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:99624", + "name": "RHSA-2026:99624", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-119079", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T18:43:39.044Z" + "dateUpdated": "2026-11-12T12:57:13.364Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/123xxx/CVE-2026-123139.json b/data/2026/123xxx/CVE-2026-123139.json new file mode 100644 index 0000000000..cb0783edf5 --- /dev/null +++ b/data/2026/123xxx/CVE-2026-123139.json @@ -0,0 +1,132 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-123139", + "assignerOrgId": "9aee7086-24f5-48b4-9428-908ac90b8b54", + "state": "PUBLISHED", + "assignerShortName": "Opera", + "dateReserved": "2026-11-05T14:21:01.547Z", + "datePublished": "2026-11-12T12:22:07.291Z", + "dateUpdated": "2026-11-12T12:22:07.291Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "9aee7086-24f5-48b4-9428-908ac90b8b54", + "shortName": "Opera", + "dateUpdated": "2026-11-12T12:22:07.291Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-940", + "description": "CWE-940 Improper verification of source of a communication channel", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-36", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-36 Using Unpublished Interfaces or Functionality" + } + ] + } + ], + "affected": [ + { + "vendor": "Opera", + "product": "Neon", + "platforms": [ + "Windows", + "MacOS" + ], + "modules": [ + "MCP Hub extension" + ], + "versions": [ + { + "status": "affected", + "version": "1.0.0", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1." + } + ] + } + ], + "references": [ + { + "url": "https://security.opera.com/en/improper-verification-of-source-of-a-communication-channel-opera-security-advisories/" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "PASSIVE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "UNREPORTED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "MEDIUM", + "baseScore": 5.8, + "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U" + } + } + ], + "credits": [ + { + "lang": "en", + "value": "maitai", + "type": "finder" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123496.json b/data/2026/123xxx/CVE-2026-123496.json index b0e04dde2e..f1d5fd893d 100644 --- a/data/2026/123xxx/CVE-2026-123496.json +++ b/data/2026/123xxx/CVE-2026-123496.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:45:39.025Z", "datePublished": "2026-11-08T01:37:14.269Z", - "dateUpdated": "2026-11-08T01:37:14.269Z" + "dateUpdated": "2026-11-12T12:09:11.966Z" }, "containers": { "cna": { @@ -133,6 +133,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:01:50.971303Z", + "id": "CVE-2026-123496", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:09:11.966Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123500.json b/data/2026/123xxx/CVE-2026-123500.json index 373d273442..a2197ee7a3 100644 --- a/data/2026/123xxx/CVE-2026-123500.json +++ b/data/2026/123xxx/CVE-2026-123500.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:45:39.026Z", "datePublished": "2026-11-08T01:37:16.987Z", - "dateUpdated": "2026-11-08T01:37:16.987Z" + "dateUpdated": "2026-11-12T12:17:18.037Z" }, "containers": { "cna": { @@ -140,6 +140,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:10:53.314099Z", + "id": "CVE-2026-123500", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:17:18.037Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123504.json b/data/2026/123xxx/CVE-2026-123504.json index f51fd6c9ed..4b22f739aa 100644 --- a/data/2026/123xxx/CVE-2026-123504.json +++ b/data/2026/123xxx/CVE-2026-123504.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:45:39.026Z", "datePublished": "2026-11-08T01:37:19.759Z", - "dateUpdated": "2026-11-08T01:37:19.759Z" + "dateUpdated": "2026-11-12T12:19:23.734Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:19:03.007200Z", + "id": "CVE-2026-123504", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:19:23.734Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123508.json b/data/2026/123xxx/CVE-2026-123508.json index 135cd1f77e..ae8794efeb 100644 --- a/data/2026/123xxx/CVE-2026-123508.json +++ b/data/2026/123xxx/CVE-2026-123508.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:46:28.480Z", "datePublished": "2026-11-08T01:37:22.496Z", - "dateUpdated": "2026-11-08T01:37:22.496Z" + "dateUpdated": "2026-11-12T12:20:41.762Z" }, "containers": { "cna": { @@ -133,6 +133,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:20:18.777965Z", + "id": "CVE-2026-123508", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:20:41.762Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123512.json b/data/2026/123xxx/CVE-2026-123512.json index e078a8e785..2faaa4cc59 100644 --- a/data/2026/123xxx/CVE-2026-123512.json +++ b/data/2026/123xxx/CVE-2026-123512.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:46:28.480Z", "datePublished": "2026-11-08T01:37:25.205Z", - "dateUpdated": "2026-11-08T01:37:25.205Z" + "dateUpdated": "2026-11-12T12:21:38.415Z" }, "containers": { "cna": { @@ -133,6 +133,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:21:25.785994Z", + "id": "CVE-2026-123512", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:21:38.415Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123516.json b/data/2026/123xxx/CVE-2026-123516.json index 91403364d1..7be155c7f0 100644 --- a/data/2026/123xxx/CVE-2026-123516.json +++ b/data/2026/123xxx/CVE-2026-123516.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:47:14.649Z", "datePublished": "2026-11-08T01:37:28.063Z", - "dateUpdated": "2026-11-08T01:37:28.063Z" + "dateUpdated": "2026-11-12T12:32:15.609Z" }, "containers": { "cna": { @@ -140,6 +140,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:28:33.141176Z", + "id": "CVE-2026-123516", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:32:15.609Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123520.json b/data/2026/123xxx/CVE-2026-123520.json index afa745715c..ce99841251 100644 --- a/data/2026/123xxx/CVE-2026-123520.json +++ b/data/2026/123xxx/CVE-2026-123520.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:47:14.649Z", "datePublished": "2026-11-08T01:37:31.078Z", - "dateUpdated": "2026-11-08T01:37:31.078Z" + "dateUpdated": "2026-11-12T12:35:04.512Z" }, "containers": { "cna": { @@ -146,6 +146,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:32:46.919757Z", + "id": "CVE-2026-123520", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:35:04.512Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123524.json b/data/2026/123xxx/CVE-2026-123524.json index 209f4f9282..588c86272b 100644 --- a/data/2026/123xxx/CVE-2026-123524.json +++ b/data/2026/123xxx/CVE-2026-123524.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:47:14.650Z", "datePublished": "2026-11-08T01:37:34.226Z", - "dateUpdated": "2026-11-08T01:37:34.226Z" + "dateUpdated": "2026-11-12T12:38:23.426Z" }, "containers": { "cna": { @@ -141,6 +141,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-66cq-j6rw-pjch", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:36:29.006074Z", + "id": "CVE-2026-123524", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:38:23.426Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123532.json b/data/2026/123xxx/CVE-2026-123532.json index b55ebec54c..ebb928cd3c 100644 --- a/data/2026/123xxx/CVE-2026-123532.json +++ b/data/2026/123xxx/CVE-2026-123532.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:48:01.382Z", "datePublished": "2026-11-08T01:37:40.982Z", - "dateUpdated": "2026-11-08T01:37:40.982Z" + "dateUpdated": "2026-11-12T12:44:47.300Z" }, "containers": { "cna": { @@ -145,6 +145,48 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "references": [ + { + "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-xw69-xv93-5fjv", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:41:13.560830Z", + "id": "CVE-2026-123532", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:44:47.300Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123536.json b/data/2026/123xxx/CVE-2026-123536.json index 76a55bffed..30bfd57d48 100644 --- a/data/2026/123xxx/CVE-2026-123536.json +++ b/data/2026/123xxx/CVE-2026-123536.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:48:46.279Z", "datePublished": "2026-11-08T01:37:43.836Z", - "dateUpdated": "2026-11-08T01:37:43.836Z" + "dateUpdated": "2026-11-12T12:50:04.334Z" }, "containers": { "cna": { @@ -155,6 +155,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:46:15.486866Z", + "id": "CVE-2026-123536", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:50:04.334Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123540.json b/data/2026/123xxx/CVE-2026-123540.json index 13b93827df..bfb7e6880d 100644 --- a/data/2026/123xxx/CVE-2026-123540.json +++ b/data/2026/123xxx/CVE-2026-123540.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:48:46.279Z", "datePublished": "2026-11-08T01:37:46.615Z", - "dateUpdated": "2026-11-08T01:37:46.615Z" + "dateUpdated": "2026-11-12T12:52:06.326Z" }, "containers": { "cna": { @@ -155,6 +155,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:51:17.655557Z", + "id": "CVE-2026-123540", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:52:06.326Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123544.json b/data/2026/123xxx/CVE-2026-123544.json index f895591ae8..6cd66aa2c0 100644 --- a/data/2026/123xxx/CVE-2026-123544.json +++ b/data/2026/123xxx/CVE-2026-123544.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:48:46.280Z", "datePublished": "2026-11-08T01:37:50.045Z", - "dateUpdated": "2026-11-08T01:37:50.045Z" + "dateUpdated": "2026-11-12T12:53:17.928Z" }, "containers": { "cna": { @@ -228,6 +228,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:52:59.072310Z", + "id": "CVE-2026-123544", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:53:17.928Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123548.json b/data/2026/123xxx/CVE-2026-123548.json index b5d08d7524..7ac6e6d09f 100644 --- a/data/2026/123xxx/CVE-2026-123548.json +++ b/data/2026/123xxx/CVE-2026-123548.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:49:30.576Z", "datePublished": "2026-11-08T01:37:52.819Z", - "dateUpdated": "2026-11-08T01:37:52.819Z" + "dateUpdated": "2026-11-12T12:54:22.987Z" }, "containers": { "cna": { @@ -189,6 +189,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:53:35.968589Z", + "id": "CVE-2026-123548", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:54:22.987Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123552.json b/data/2026/123xxx/CVE-2026-123552.json index 18f1eb081c..1595c8525b 100644 --- a/data/2026/123xxx/CVE-2026-123552.json +++ b/data/2026/123xxx/CVE-2026-123552.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:49:30.576Z", "datePublished": "2026-11-08T01:37:55.523Z", - "dateUpdated": "2026-11-08T01:37:55.523Z" + "dateUpdated": "2026-11-12T12:56:09.609Z" }, "containers": { "cna": { @@ -150,6 +150,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:55:48.528637Z", + "id": "CVE-2026-123552", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:56:09.609Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123556.json b/data/2026/123xxx/CVE-2026-123556.json index 005b4a7011..12ce9273cb 100644 --- a/data/2026/123xxx/CVE-2026-123556.json +++ b/data/2026/123xxx/CVE-2026-123556.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:50:45.483Z", "datePublished": "2026-11-08T01:37:58.283Z", - "dateUpdated": "2026-11-08T01:37:58.283Z" + "dateUpdated": "2026-11-12T12:57:04.693Z" }, "containers": { "cna": { @@ -151,6 +151,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:56:50.326321Z", + "id": "CVE-2026-123556", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:57:04.693Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123560.json b/data/2026/123xxx/CVE-2026-123560.json index 4638043feb..de3bbd4b00 100644 --- a/data/2026/123xxx/CVE-2026-123560.json +++ b/data/2026/123xxx/CVE-2026-123560.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:50:45.483Z", "datePublished": "2026-11-08T01:38:01.040Z", - "dateUpdated": "2026-11-08T01:38:01.040Z" + "dateUpdated": "2026-11-12T12:59:51.619Z" }, "containers": { "cna": { @@ -150,6 +150,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T12:58:05.934171Z", + "id": "CVE-2026-123560", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T12:59:51.619Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123564.json b/data/2026/123xxx/CVE-2026-123564.json index 59414aacc3..247dbda3f3 100644 --- a/data/2026/123xxx/CVE-2026-123564.json +++ b/data/2026/123xxx/CVE-2026-123564.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:50:45.483Z", "datePublished": "2026-11-08T01:38:03.802Z", - "dateUpdated": "2026-11-08T01:38:03.802Z" + "dateUpdated": "2026-11-12T13:02:42.004Z" }, "containers": { "cna": { @@ -148,6 +148,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T13:02:04.902891Z", + "id": "CVE-2026-123564", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T13:02:42.004Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123568.json b/data/2026/123xxx/CVE-2026-123568.json index 3ac1c477bc..c79f47f378 100644 --- a/data/2026/123xxx/CVE-2026-123568.json +++ b/data/2026/123xxx/CVE-2026-123568.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:53:14.312Z", "datePublished": "2026-11-08T01:38:06.526Z", - "dateUpdated": "2026-11-08T01:38:06.526Z" + "dateUpdated": "2026-11-12T13:03:37.545Z" }, "containers": { "cna": { @@ -140,6 +140,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T13:03:03.428600Z", + "id": "CVE-2026-123568", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T13:03:37.545Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123576.json b/data/2026/123xxx/CVE-2026-123576.json index 50c883bb8c..33c44479b2 100644 --- a/data/2026/123xxx/CVE-2026-123576.json +++ b/data/2026/123xxx/CVE-2026-123576.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:55:55.660Z", "datePublished": "2026-11-08T01:38:11.970Z", - "dateUpdated": "2026-11-08T01:38:11.970Z" + "dateUpdated": "2026-11-12T13:05:36.949Z" }, "containers": { "cna": { @@ -125,6 +125,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T13:04:12.113455Z", + "id": "CVE-2026-123576", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T13:05:36.949Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123580.json b/data/2026/123xxx/CVE-2026-123580.json index 472bfee86e..4494d25bef 100644 --- a/data/2026/123xxx/CVE-2026-123580.json +++ b/data/2026/123xxx/CVE-2026-123580.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:55:55.661Z", "datePublished": "2026-11-08T01:38:14.779Z", - "dateUpdated": "2026-11-08T01:38:14.779Z" + "dateUpdated": "2026-11-12T13:08:17.209Z" }, "containers": { "cna": { @@ -137,6 +137,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T13:07:24.535038Z", + "id": "CVE-2026-123580", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T13:08:17.209Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123584.json b/data/2026/123xxx/CVE-2026-123584.json index 643b917d6b..db756cf7d9 100644 --- a/data/2026/123xxx/CVE-2026-123584.json +++ b/data/2026/123xxx/CVE-2026-123584.json @@ -8,7 +8,7 @@ "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T00:55:55.661Z", "datePublished": "2026-11-08T01:38:17.587Z", - "dateUpdated": "2026-11-08T01:38:17.587Z" + "dateUpdated": "2026-11-12T13:14:32.200Z" }, "containers": { "cna": { @@ -123,6 +123,40 @@ "x_generator": { "engine": "vulncheck-endgame" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-12T13:13:27.750747Z", + "id": "CVE-2026-123584", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-12T13:14:32.200Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125285.json b/data/2026/125xxx/CVE-2026-125285.json new file mode 100644 index 0000000000..dcb7789378 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125285.json @@ -0,0 +1,110 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125285", + "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", + "state": "PUBLISHED", + "assignerShortName": "tibco", + "dateReserved": "2026-11-09T18:49:48.747Z", + "datePublished": "2026-11-12T12:56:27.620Z", + "dateUpdated": "2026-11-12T12:56:27.620Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", + "shortName": "tibco", + "dateUpdated": "2026-11-12T12:56:27.620Z" + }, + "title": "TIBCO Platform’s Self-Hosted Control Plane - Authentication Bypass Vulnerability", + "datePublic": "2026-11-12T12:15:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-288", + "description": "CWE-288 Authentication bypass using an alternate path or channel", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "TIBCO", + "product": "TIBCO Platform’s Self-Hosted Control Plane", + "versions": [ + { + "status": "affected", + "version": "1", + "lessThanOrEqual": "1.21", + "versionType": "Patch" + } + ], + "defaultStatus": "affected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane.\n\nThis issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane.This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.
" + } + ] + } + ], + "references": [ + { + "url": "https://community.tibco.com/advisories/tibco-security-advisory-november-12-2026-tibco-platform-cve-2026-125285-r232/" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "LOW", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 8.8, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125870.json b/data/2026/125xxx/CVE-2026-125870.json new file mode 100644 index 0000000000..05f5aec463 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125870.json @@ -0,0 +1,160 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125870", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-10T12:49:12.435Z", + "datePublished": "2026-11-12T12:48:05.387Z", + "dateUpdated": "2026-11-12T12:49:16.026Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-12T12:49:16.026Z" + }, + "title": "BookStack before 26.09.3 Broken Access Control via ImageController", + "descriptions": [ + { + "lang": "en", + "value": "BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored." + } + ], + "tags": [ + "x_open-source" + ], + "datePublic": "2026-11-12T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Incorrect Authorization", + "cweId": "CWE-863", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "bookstackapp", + "product": "bookstack", + "packageURL": "pkg:github/bookstackapp/bookstack", + "repo": "https://github.com/bookstackapp/bookstack", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "custom", + "lessThan": "26.09.3" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "LOW", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "LOW", + "baseScore": 2.3, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "version": "3.1", + "baseSeverity": "MEDIUM", + "baseScore": 4.2, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + } + ], + "references": [ + { + "url": "https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3", + "name": "Vendor Patch (Codeberg)", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3", + "name": "Vendor Patch (GitHub)", + "tags": [ + "patch" + ] + }, + { + "url": "https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/", + "name": "Vendor Advisory", + "tags": [ + "vendor-advisory" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/bookstack-before-broken-access-control-via-imagecontroller", + "name": "VulnCheck Advisory: BookStack before 26.09.3 Broken Access Control via ImageController", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "CayCon", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126256.json b/data/2026/126xxx/CVE-2026-126256.json index 10bcc67dcb..8e5f77515e 100644 --- a/data/2026/126xxx/CVE-2026-126256.json +++ b/data/2026/126xxx/CVE-2026-126256.json @@ -8,7 +8,7 @@ "assignerShortName": "fortinet", "dateReserved": "2026-11-10T20:10:03.791Z", "datePublished": "2026-11-11T21:31:52.364Z", - "dateUpdated": "2026-11-11T21:31:52.364Z" + "dateUpdated": "2026-11-12T13:03:36.420Z" }, "containers": { "cna": { @@ -17,65 +17,10 @@ "vendor": "Fortinet", "product": "FortiOS", "cpes": [ - "cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.4.13:*:*:*:*:*:*:*", - "cpe:2.3:o:fortinet:fortios:7.2.14:*:*:*:*:*:*:*" + "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ @@ -94,19 +39,13 @@ { "versionType": "semver", "version": "7.4.0", - "lessThanOrEqual": "7.4.13", + "lessThanOrEqual": "7.4.12", "status": "affected" }, { "versionType": "semver", "version": "7.2.0", - "lessThanOrEqual": "7.2.14", - "status": "affected" - }, - { - "versionType": "semver", - "version": "7.0.0", - "lessThanOrEqual": "7.0.19", + "lessThanOrEqual": "7.2.13", "status": "affected" } ] @@ -115,13 +54,13 @@ "descriptions": [ { "lang": "en", - "value": "A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets." + "value": "A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets." } ], "providerMetadata": { "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", - "dateUpdated": "2026-11-11T21:31:52.364Z" + "dateUpdated": "2026-11-12T13:03:36.420Z" }, "problemTypes": [ { @@ -157,7 +96,7 @@ "solutions": [ { "lang": "en", - "value": "Upgrade to FortiOS version 8.0.2 or above\nUpgrade to FortiOS version 7.6.8 or above" + "value": "Upgrade to 8.0.2 or above\nUpgrade to 7.6.8 or above\nUpgrade to 7.4.13 or above\nUpgrade to 7.2.14 or above" } ], "references": [ diff --git a/data/2026/126xxx/CVE-2026-126642.json b/data/2026/126xxx/CVE-2026-126642.json index dcf4c7985d..831d21b207 100644 --- a/data/2026/126xxx/CVE-2026-126642.json +++ b/data/2026/126xxx/CVE-2026-126642.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-11-11T10:46:47.354Z", "datePublished": "2026-11-12T08:29:21.412Z", - "dateUpdated": "2026-11-12T08:29:21.412Z" + "dateUpdated": "2026-11-12T13:14:11.204Z" }, "containers": { "cna": { @@ -148,10 +148,16 @@ "value": "Made public." } ], + "credits": [ + { + "lang": "en", + "value": "Red Hat would like to thank Seungwon Kim (0xRrudy) for reporting this issue." + } + ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-12T08:29:21.412Z" + "dateUpdated": "2026-11-12T13:14:11.204Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/126xxx/CVE-2026-126993.json b/data/2026/126xxx/CVE-2026-126993.json new file mode 100644 index 0000000000..836c427eb2 --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126993.json @@ -0,0 +1,171 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126993", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2026-11-12T07:52:29.790Z", + "datePublished": "2026-11-12T12:15:18.703Z", + "dateUpdated": "2026-11-12T12:15:18.703Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2026-11-12T12:15:18.703Z" + }, + "title": "SiteServer SSCMS captcha inadequate encryption", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-326", + "lang": "en", + "description": "Inadequate Encryption Strength" + } + ] + }, + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-310", + "lang": "en", + "description": "Cryptographic Issues" + } + ] + } + ], + "affected": [ + { + "vendor": "SiteServer", + "product": "SSCMS", + "versions": [ + { + "version": "7.2.0", + "status": "affected" + }, + { + "version": "7.2.1", + "status": "affected" + }, + { + "version": "7.2.2", + "status": "affected" + } + ], + "cpes": [ + "cpe:2.3:a:sscms:sscms:*:*:*:*:*:*:*:*" + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way." + } + ], + "metrics": [ + { + "cvssV4_0": { + "version": "4.0", + "baseScore": 6.9, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 5.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 5.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 4.3, + "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C" + } + } + ], + "timeline": [ + { + "time": "2026-11-12T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2026-11-12T01:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2026-11-12T08:57:34.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "ssss-s (VulDB User)", + "type": "reporter" + }, + { + "lang": "en", + "value": "VulDB CNA Team", + "type": "coordinator" + } + ], + "references": [ + { + "url": "https://vuldb.com/vuln/436288", + "name": "VDB-436288 | SiteServer SSCMS captcha inadequate encryption", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/vuln/436288/cti", + "name": "VDB-436288 | CTI Indicators (IOB, IOC, TTP, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://vuldb.com/cve/CVE-2026-126993", + "name": "CVE-2026-126993 | CVE Analysis and Report", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://vuldb.com/submit/1040543", + "name": "Submit #1040543 | SSCMS 7.2.2 | Weak key derivation / cryptographic token forgery / SSTI", + "tags": [ + "third-party-advisory" + ] + } + ], + "x_generator": [ + "VulDB PVTS v202611" + ] + } + } +} \ No newline at end of file diff --git a/data/2026/126xxx/CVE-2026-126994.json b/data/2026/126xxx/CVE-2026-126994.json new file mode 100644 index 0000000000..3fd7402d4a --- /dev/null +++ b/data/2026/126xxx/CVE-2026-126994.json @@ -0,0 +1,199 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-126994", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2026-11-12T07:57:21.265Z", + "datePublished": "2026-11-12T12:30:27.079Z", + "dateUpdated": "2026-11-12T12:30:27.079Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2026-11-12T12:30:27.079Z" + }, + "title": "braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-470", + "lang": "en", + "description": "Use of Externally-Controlled Input to Select Classes or Code" + } + ] + } + ], + "affected": [ + { + "vendor": "n/a", + "product": "braindecode", + "versions": [ + { + "version": "1.8.0", + "status": "affected" + }, + { + "version": "1.8.1", + "status": "affected" + }, + { + "version": "2.0.0", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:2.3:a:braindecode:braindecode:*:*:*:*:*:*:*:*" + ], + "modules": [ + "Model Config Deserialization" + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded." + } + ], + "metrics": [ + { + "cvssV4_0": { + "version": "4.0", + "baseScore": 5.3, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 7.5, + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C" + } + } + ], + "timeline": [ + { + "time": "2026-11-12T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2026-11-12T01:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2026-11-12T09:02:26.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "Dem00000 (VulDB User)", + "type": "reporter" + } + ], + "references": [ + { + "url": "https://vuldb.com/vuln/436293", + "name": "VDB-436293 | braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/vuln/436293/cti", + "name": "VDB-436293 | CTI Indicators (IOB, IOC, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://vuldb.com/cve/CVE-2026-126994", + "name": "CVE-2026-126994 | CVE Analysis and Report", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://vuldb.com/submit/1040635", + "name": "Submit #1040635 | braindecode 1.4.0 to 1.8.1 (commit adaa63a8ac7510d0976ee134f6a9ff8e916ef37d) Unsafe Reflection", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://github.com/braindecode/braindecode/issues/1441", + "tags": [ + "issue-tracking" + ] + }, + { + "url": "https://github.com/braindecode/braindecode/pull/1494", + "tags": [ + "issue-tracking", + "patch" + ] + }, + { + "url": "https://github.com/user-attachments/files/33599402/poc.zip", + "tags": [ + "exploit" + ] + }, + { + "url": "https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/braindecode/braindecode/releases/tag/v2.0.0", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/braindecode/braindecode/", + "tags": [ + "product" + ] + } + ], + "tags": [ + "x_open-source" + ], + "x_generator": [ + "VulDB PVTS v202611" + ] + } + } +} \ No newline at end of file diff --git a/data/2026/127xxx/CVE-2026-127036.json b/data/2026/127xxx/CVE-2026-127036.json index d615dc9ba5..9f7c80fea8 100644 --- a/data/2026/127xxx/CVE-2026-127036.json +++ b/data/2026/127xxx/CVE-2026-127036.json @@ -8,16 +8,16 @@ "assignerShortName": "tibco", "dateReserved": "2026-11-12T11:10:34.166Z", "datePublished": "2026-11-12T11:34:16.443Z", - "dateUpdated": "2026-11-12T11:34:16.443Z" + "dateUpdated": "2026-11-12T12:09:55.650Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", - "dateUpdated": "2026-11-12T11:34:16.443Z" + "dateUpdated": "2026-11-12T12:09:55.650Z" }, - "title": "ibi WebFOCUS - Reflected XSS & OS Command Injection Vulnerability", + "title": "ibi WebFOCUS - OS Command Injection Vulnerability", "datePublic": "2026-11-12T11:30:00.000Z", "problemTypes": [ { diff --git a/data/2026/127xxx/CVE-2026-127050.json b/data/2026/127xxx/CVE-2026-127050.json new file mode 100644 index 0000000000..55b4796ffa --- /dev/null +++ b/data/2026/127xxx/CVE-2026-127050.json @@ -0,0 +1,145 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-127050", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-12T12:23:32.735Z", + "datePublished": "2026-11-12T12:25:41.651Z", + "dateUpdated": "2026-11-12T12:25:41.651Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-12T12:25:41.651Z" + }, + "title": "Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback", + "descriptions": [ + { + "lang": "en", + "value": "Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing \"..\" sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution." + } + ], + "tags": [ + "x_open-source" + ], + "datePublic": "2026-11-12T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", + "cweId": "CWE-22", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "inisev", + "product": "Backup Migration", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "semver", + "lessThan": "2.1.8" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "attackRequirements": "PRESENT", + "privilegesRequired": "HIGH", + "userInteraction": "ACTIVE", + "vulnConfidentialityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 7.1, + "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "HIGH", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "version": "3.1", + "baseSeverity": "MEDIUM", + "baseScore": 6.4, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + } + ], + "references": [ + { + "url": "https://wordpress.org/plugins/backup-backup/#developers", + "name": "Vendor Patch", + "tags": [ + "patch", + "release-notes" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/backup-migration-before-path-traversal-via-pclzip-restore-fallback", + "name": "VulnCheck Advisory: Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Yll Berisha", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/127xxx/CVE-2026-127056.json b/data/2026/127xxx/CVE-2026-127056.json new file mode 100644 index 0000000000..355c4cf33a --- /dev/null +++ b/data/2026/127xxx/CVE-2026-127056.json @@ -0,0 +1,152 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-127056", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-12T12:36:45.834Z", + "datePublished": "2026-11-12T12:39:13.552Z", + "dateUpdated": "2026-11-12T12:39:13.552Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-12T12:39:13.552Z" + }, + "title": "PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan", + "descriptions": [ + { + "lang": "en", + "value": "PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab." + } + ], + "tags": [ + "x_open-source" + ], + "datePublic": "2026-11-12T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Inefficient Algorithmic Complexity", + "cweId": "CWE-407", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "mholt", + "product": "PapaParse", + "packageURL": "pkg:npm/papaparse", + "repo": "https://github.com/mholt/PapaParse", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "semver", + "lessThan": "5.7.1" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "HIGH", + "baseScore": 8.7, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH", + "version": "3.1", + "baseSeverity": "HIGH", + "baseScore": 7.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + } + ], + "references": [ + { + "url": "https://www.npmjs.com/package/papaparse", + "name": "Vendor Patch", + "tags": [ + "patch" + ] + }, + { + "url": "https://github.com/mholt/PapaParse/commit/a50fe19aae08b966de444119333fe4a8b7aa6b2f", + "tags": [ + "issue-tracking" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/papaparse-before-quadratic-time-parsing-dos-via-indexof-scan", + "name": "VulnCheck Advisory: PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Muhammadyusuf Dilmurodov (agrresore)", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/127xxx/CVE-2026-127058.json b/data/2026/127xxx/CVE-2026-127058.json new file mode 100644 index 0000000000..cffea5aec8 --- /dev/null +++ b/data/2026/127xxx/CVE-2026-127058.json @@ -0,0 +1,159 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-127058", + "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "state": "PUBLISHED", + "assignerShortName": "VulnCheck", + "dateReserved": "2026-11-12T13:05:14.832Z", + "datePublished": "2026-11-12T13:09:59.086Z", + "dateUpdated": "2026-11-12T13:09:59.086Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", + "shortName": "VulnCheck", + "dateUpdated": "2026-11-12T13:09:59.086Z" + }, + "title": "WonderCMS before 3.7.0 Unverified Password Change via saveAction", + "descriptions": [ + { + "lang": "en", + "value": "WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account." + } + ], + "tags": [ + "x_open-source" + ], + "datePublic": "2026-11-12T00:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "Unverified Password Change", + "cweId": "CWE-620", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "defaultStatus": "unaffected", + "vendor": "WonderCMS", + "product": "wondercms", + "packageURL": "pkg:github/WonderCMS/wondercms", + "repo": "https://github.com/WonderCMS/wondercms", + "versions": [ + { + "status": "affected", + "version": "0", + "versionType": "semver", + "lessThan": "3.7.0" + } + ] + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "subIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED", + "version": "4.0", + "baseSeverity": "MEDIUM", + "baseScore": 6.9, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } + }, + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE", + "version": "3.1", + "baseSeverity": "MEDIUM", + "baseScore": 4.9, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N" + } + } + ], + "references": [ + { + "url": "https://github.com/WonderCMS/wondercms/security/advisories/GHSA-qc3r-v7fc-24xc", + "name": "Vendor Advisory", + "tags": [ + "vendor-advisory" + ] + }, + { + "url": "https://github.com/WonderCMS/wondercms/releases#release-3.7.0", + "name": "Vendor Patch", + "tags": [ + "release-notes", + "patch" + ] + }, + { + "url": "https://www.vulncheck.com/advisories/wondercms-before-unverified-password-change-via-saveaction", + "name": "VulnCheck Advisory: WonderCMS before 3.7.0 Unverified Password Change via saveAction", + "tags": [ + "third-party-advisory" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "Harsh Raj Singhania", + "type": "reporter" + }, + { + "lang": "en", + "value": "manop55555", + "type": "finder" + } + ], + "x_generator": { + "engine": "vulncheck" + } + } + } +} \ No newline at end of file diff --git a/data/2026/19xxx/CVE-2026-19422.json b/data/2026/19xxx/CVE-2026-19422.json new file mode 100644 index 0000000000..dc9e902764 --- /dev/null +++ b/data/2026/19xxx/CVE-2026-19422.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-19422", + "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "state": "PUBLISHED", + "assignerShortName": "Zohocorp", + "dateReserved": "2026-08-10T10:54:36.168Z", + "datePublished": "2026-11-12T12:16:50.068Z", + "dateUpdated": "2026-11-12T12:16:50.068Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "shortName": "Zohocorp", + "dateUpdated": "2026-11-12T12:16:50.068Z" + }, + "title": "Authentication Bypass", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-306", + "description": "CWE-306 – Missing Authentication for Critical Function", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-115", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-115 – Authentication Bypass" + } + ] + } + ], + "affected": [ + { + "vendor": "Zohocorp", + "product": "DDI Central", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "6301", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0", + "versionEndExcluding": "6301" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications." + } + ] + } + ], + "references": [ + { + "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "CRITICAL", + "baseScore": 9.1, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/75xxx/CVE-2026-75864.json b/data/2026/75xxx/CVE-2026-75864.json new file mode 100644 index 0000000000..e312c9b5ed --- /dev/null +++ b/data/2026/75xxx/CVE-2026-75864.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-75864", + "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "state": "PUBLISHED", + "assignerShortName": "Zohocorp", + "dateReserved": "2026-08-18T11:08:19.652Z", + "datePublished": "2026-11-12T12:21:11.903Z", + "dateUpdated": "2026-11-12T12:21:11.903Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "shortName": "Zohocorp", + "dateUpdated": "2026-11-12T12:21:11.903Z" + }, + "title": "Broken Access Control", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-862", + "description": "CWE-862 – Missing Authorization", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-122", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-122 – Privilege Abuse" + } + ] + } + ], + "affected": [ + { + "vendor": "Zohocorp", + "product": "DDI Central", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "6301", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0", + "versionEndExcluding": "6301" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope." + } + ] + } + ], + "references": [ + { + "url": "https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75864.html" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 8.1, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/75xxx/CVE-2026-75867.json b/data/2026/75xxx/CVE-2026-75867.json new file mode 100644 index 0000000000..f3ee4022d4 --- /dev/null +++ b/data/2026/75xxx/CVE-2026-75867.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-75867", + "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "state": "PUBLISHED", + "assignerShortName": "Zohocorp", + "dateReserved": "2026-08-18T11:54:25.454Z", + "datePublished": "2026-11-12T12:26:47.217Z", + "dateUpdated": "2026-11-12T12:26:47.217Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "shortName": "Zohocorp", + "dateUpdated": "2026-11-12T12:26:47.217Z" + }, + "title": "Broken Access Control", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "CWE-863 – Incorrect Authorization", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-180", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels" + } + ] + } + ], + "affected": [ + { + "vendor": "Zohocorp", + "product": "DDI Central", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "6301", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0", + "versionEndExcluding": "6301" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters." + } + ] + } + ], + "references": [ + { + "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75867.html" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 8.1, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/75xxx/CVE-2026-75868.json b/data/2026/75xxx/CVE-2026-75868.json new file mode 100644 index 0000000000..c31e70c4fb --- /dev/null +++ b/data/2026/75xxx/CVE-2026-75868.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-75868", + "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "state": "PUBLISHED", + "assignerShortName": "Zohocorp", + "dateReserved": "2026-08-18T11:54:41.495Z", + "datePublished": "2026-11-12T12:30:33.462Z", + "dateUpdated": "2026-11-12T12:30:33.462Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "shortName": "Zohocorp", + "dateUpdated": "2026-11-12T12:30:33.462Z" + }, + "title": "Broken Access Control", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-863", + "description": "CWE-863 – Incorrect Authorization", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-180", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels" + } + ] + } + ], + "affected": [ + { + "vendor": "Zohocorp", + "product": "DDI Central", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "6301", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0", + "versionEndExcluding": "6301" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters." + } + ] + } + ], + "references": [ + { + "url": "https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75868.html" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 8.1, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/75xxx/CVE-2026-75869.json b/data/2026/75xxx/CVE-2026-75869.json new file mode 100644 index 0000000000..c7ebfbed27 --- /dev/null +++ b/data/2026/75xxx/CVE-2026-75869.json @@ -0,0 +1,129 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-75869", + "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "state": "PUBLISHED", + "assignerShortName": "Zohocorp", + "dateReserved": "2026-08-18T11:56:23.283Z", + "datePublished": "2026-11-12T12:40:30.592Z", + "dateUpdated": "2026-11-12T12:40:30.592Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", + "shortName": "Zohocorp", + "dateUpdated": "2026-11-12T12:40:30.592Z" + }, + "title": "Authenticated command injection", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-78", + "description": "CWE-78 – Improper Neutralization of Special Elements used in an OS Command", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-180", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels" + } + ] + } + ], + "affected": [ + { + "vendor": "Zohocorp", + "product": "DDI Central", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThan": "6301", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + ], + "cpeApplicability": [ + { + "operator": "OR", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0", + "versionEndExcluding": "6301" + } + ] + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values." + } + ] + } + ], + "references": [ + { + "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75869.html" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseSeverity": "HIGH", + "baseScore": 8.8, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "Vulnogram 1.0.5" + } + } + } +} \ No newline at end of file diff --git a/data/2026/91xxx/CVE-2026-91150.json b/data/2026/91xxx/CVE-2026-91150.json index 34da26e8b3..fa7c7972f2 100644 --- a/data/2026/91xxx/CVE-2026-91150.json +++ b/data/2026/91xxx/CVE-2026-91150.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-14T20:36:53.441Z", "datePublished": "2026-11-11T18:38:12.565Z", - "dateUpdated": "2026-11-12T11:45:09.204Z" + "dateUpdated": "2026-11-12T12:53:25.555Z" }, "containers": { "cna": { @@ -86,12 +86,21 @@ }, { "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 7", + "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", + "versions": [ + { + "version": "0:366.1.1-1.el9_9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/o:redhat:rhel_els:7" + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, { @@ -100,8 +109,27 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", + "versions": [ + { + "version": "0:366.1.1-1.el9_9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:9" + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/o:redhat:enterprise_linux:9::baseos" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "cpes": [ + "cpe:/o:redhat:rhel_els:7" ] }, { @@ -144,6 +172,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99602", + "name": "RHSA-2026:99602", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:99603", "name": "RHSA-2026:99603", @@ -209,7 +245,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-12T11:45:09.204Z" + "dateUpdated": "2026-11-12T12:53:25.555Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/91xxx/CVE-2026-91151.json b/data/2026/91xxx/CVE-2026-91151.json index c30eff7d2d..8b9339d45f 100644 --- a/data/2026/91xxx/CVE-2026-91151.json +++ b/data/2026/91xxx/CVE-2026-91151.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-14T20:37:18.522Z", "datePublished": "2026-11-11T19:46:14.718Z", - "dateUpdated": "2026-11-12T11:45:09.245Z" + "dateUpdated": "2026-11-12T12:53:27.125Z" }, "containers": { "cna": { @@ -86,12 +86,21 @@ }, { "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 7", + "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", + "versions": [ + { + "version": "0:366.1.1-1.el9_9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/o:redhat:rhel_els:7" + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, { @@ -100,8 +109,27 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", + "versions": [ + { + "version": "0:366.1.1-1.el9_9", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:9" + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/o:redhat:enterprise_linux:9::baseos" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 7", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "cockpit", + "defaultStatus": "affected", + "cpes": [ + "cpe:/o:redhat:rhel_els:7" ] }, { @@ -144,6 +172,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:99602", + "name": "RHSA-2026:99602", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:99603", "name": "RHSA-2026:99603", @@ -209,7 +245,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-12T11:45:09.245Z" + "dateUpdated": "2026-11-12T12:53:27.125Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/97xxx/CVE-2026-97845.json b/data/2026/97xxx/CVE-2026-97845.json new file mode 100644 index 0000000000..31bad1fc09 --- /dev/null +++ b/data/2026/97xxx/CVE-2026-97845.json @@ -0,0 +1,181 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-97845", + "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", + "state": "PUBLISHED", + "assignerShortName": "Qt", + "dateReserved": "2026-09-25T05:24:04.653Z", + "datePublished": "2026-11-12T13:08:43.473Z", + "dateUpdated": "2026-11-12T13:08:43.473Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", + "shortName": "Qt", + "dateUpdated": "2026-11-12T13:08:43.473Z" + }, + "title": "Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt", + "datePublic": "2026-11-12T13:00:00.000Z", + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-674", + "description": "CWE-674 Uncontrolled Recursion", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-230", + "descriptions": [ + { + "lang": "en", + "value": "CAPEC-230 Serialized Data with Nested Payloads" + } + ] + } + ], + "affected": [ + { + "vendor": "qt", + "product": "qt", + "modules": [ + "qtbase", + "qt5compat" + ], + "versions": [ + { + "status": "unknown", + "version": "0", + "lessThan": "5.0.0", + "versionType": "python" + }, + { + "status": "affected", + "version": "5.0.0", + "lessThan": "6.8.10", + "versionType": "python" + }, + { + "status": "affected", + "version": "6.9.0", + "lessThan": "6.11.3", + "versionType": "python" + } + ], + "defaultStatus": "unaffected", + "cpes": [ + "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", + "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*", + "cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*" + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).