VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-15T02:13:54Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-15 03:13:59 +01:00
1 parent c4cd4f2203
commit 4bf6a7634a
18 files changed
+2215 -29560
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2026/109xxx/CVE-2026-109618.json
+12 -6
View File
@@ -8,7 +8,7 @@
"assignerShortName": "php",
"dateReserved": "2026-10-12T21:03:58.117Z",
"datePublished": "2026-10-21T13:48:34.845Z",
"dateUpdated": "2026-11-05T18:17:38.313Z"
"dateUpdated": "2026-11-15T00:15:58.835Z"
},
"containers": {
"cna": {
@@ -304,7 +304,11 @@
]
},
{
"title": "CVE Program Container",
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-11-15T00:15:58.835Z"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
@@ -314,12 +318,14 @@
},
{
"url": "http://seclists.org/fulldisclosure/2026/Oct/51"
},
{
"url": "https://github.com/rapid7/metasploit-framework/pull/22139"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-10-29T06:08:47.615Z"
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
data/2026/119xxx/CVE-2026-119618.json
+5 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-30T12:32:13.904Z",
"datePublished": "2026-11-11T14:54:08.155Z",
"dateUpdated": "2026-11-14T04:56:47.271Z"
"dateUpdated": "2026-11-15T00:13:43.087Z"
},
"containers": {
"cna": {
@@ -118,7 +118,7 @@
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-11-12T20:56:56.991Z"
"dateUpdated": "2026-11-15T00:13:43.087Z"
},
"references": [
{
@@ -141,6 +141,9 @@
},
{
"url": "https://ubuntu.com/security/CVE-2026-119618"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567318"
}
],
"title": "CVE Program Container",
data/2026/129xxx/CVE-2026-129351.json
+175
View File
@@ -0,0 +1,175 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129351",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:31:24.764Z",
"datePublished": "2026-11-14T22:30:23.821Z",
"dateUpdated": "2026-11-14T22:30:23.821Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-14T22:30:23.821Z"
},
"title": "TRENDnet TEW-657BRM mini_httpd setup.cgi sprintf out-of-bounds write",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-787",
"lang": "en",
"description": "Out-of-bounds Write"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-119",
"lang": "en",
"description": "Memory Corruption"
}
]
}
],
"affected": [
{
"vendor": "TRENDnet",
"product": "TEW-657BRM",
"versions": [
{
"version": "1.00.1",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:o:trendnet:tew-657brm_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"mini_httpd"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component mini_httpd. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor explains: \"\"I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know.\" This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 10,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 10,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 10,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:36:35.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "ruanyi (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437397",
"name": "VDB-437397 | TRENDnet TEW-657BRM mini_httpd setup.cgi sprintf out-of-bounds write",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/437397/cti",
"name": "VDB-437397 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129351",
"name": "CVE-2026-129351 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1043518",
"name": "Submit #1043518 | TRENDnet TEW-657BRM 1.00.1 Buffer Overflow",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-mini_httpd.md",
"tags": [
"exploit"
]
}
],
"tags": [
"unsupported-when-assigned"
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/129xxx/CVE-2026-129352.json
+170
View File
@@ -0,0 +1,170 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129352",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:31:28.857Z",
"datePublished": "2026-11-14T23:00:27.224Z",
"dateUpdated": "2026-11-14T23:00:27.224Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-14T23:00:27.224Z"
},
"title": "TRENDnet TEW-657BRM upgrade_flash.cgi stack-based overflow",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-121",
"lang": "en",
"description": "Stack-based Buffer Overflow"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-119",
"lang": "en",
"description": "Memory Corruption"
}
]
}
],
"affected": [
{
"vendor": "TRENDnet",
"product": "TEW-657BRM",
"versions": [
{
"version": "1.00.1",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:o:trendnet:tew-657brm_firmware:*:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/upgrade_flash.cgi. Performing a manipulation of the argument boundary results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor explains: \"\"I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know.\""
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 9.4,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 9.1,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:36:40.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "ruanyi (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437398",
"name": "VDB-437398 | TRENDnet TEW-657BRM upgrade_flash.cgi stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/437398/cti",
"name": "VDB-437398 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129352",
"name": "CVE-2026-129352 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1043522",
"name": "Submit #1043522 | TRENDnet TEW-657BRM 1.00.1 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-upgrade_flash.md",
"tags": [
"exploit",
"patch"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/129xxx/CVE-2026-129353.json
+174
View File
@@ -0,0 +1,174 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129353",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:37:47.711Z",
"datePublished": "2026-11-14T23:15:19.934Z",
"dateUpdated": "2026-11-14T23:15:19.934Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-14T23:15:19.934Z"
},
"title": "D-Link DIR-600L authentication.cgi authenticationcgi_main stack-based overflow",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-121",
"lang": "en",
"description": "Stack-based Buffer Overflow"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-119",
"lang": "en",
"description": "Memory Corruption"
}
]
}
],
"affected": [
{
"vendor": "D-Link",
"product": "DIR-600L",
"versions": [
{
"version": "2.17",
"status": "affected"
},
{
"version": "2.17b02",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:h:d-link:dir-600l:*:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 10,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 10,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 10,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:43:20.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "ruanyi (VulDB User)",
"type": "reporter"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437416",
"name": "VDB-437416 | D-Link DIR-600L authentication.cgi authenticationcgi_main stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/437416/cti",
"name": "VDB-437416 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129353",
"name": "CVE-2026-129353 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1043523",
"name": "Submit #1043523 | D-Link DIR-600L 2.17b02 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/D-Link-DIR-600L-authentication-cgi.md",
"tags": [
"exploit"
]
},
{
"url": "https://www.dlink.com/",
"tags": [
"product"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/129xxx/CVE-2026-129354.json
+173
View File
@@ -0,0 +1,173 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129354",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:38:12.433Z",
"datePublished": "2026-11-15T00:45:26.093Z",
"dateUpdated": "2026-11-15T00:45:26.093Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-15T00:45:26.093Z"
},
"title": "D-Link DIR-600L HNAP cgibin hnap_main stack-based overflow",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-121",
"lang": "en",
"description": "Stack-based Buffer Overflow"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-119",
"lang": "en",
"description": "Memory Corruption"
}
]
}
],
"affected": [
{
"vendor": "D-Link",
"product": "DIR-600L",
"versions": [
{
"version": "2.17b02",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:h:d-link:dir-600l:*:*:*:*:*:*:*:*"
],
"modules": [
"HNAP Handler"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in D-Link DIR-600L 2.17b02. Affected by this issue is the function hnap_main of the file htdocs/cgibin of the component HNAP Handler. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 10,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 10,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 10,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"baseSeverity": "CRITICAL"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:43:26.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "ruanyi (VulDB User)",
"type": "reporter"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437417",
"name": "VDB-437417 | D-Link DIR-600L HNAP cgibin hnap_main stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/437417/cti",
"name": "VDB-437417 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129354",
"name": "CVE-2026-129354 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1043526",
"name": "Submit #1043526 | D-Link DIR-600L 2.17b02 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/D-Link-DIR-600L-HNAP-SOAPAction.md",
"tags": [
"exploit"
]
},
{
"url": "https://www.dlink.com/",
"tags": [
"product"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/129xxx/CVE-2026-129355.json
+366
View File
@@ -0,0 +1,366 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129355",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:39:47.371Z",
"datePublished": "2026-11-15T01:00:26.308Z",
"dateUpdated": "2026-11-15T01:00:26.308Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-15T01:00:26.308Z"
},
"title": "sigoden dufs WebDAV COPY Operation server.rs authorization",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-863",
"lang": "en",
"description": "Incorrect Authorization"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-285",
"lang": "en",
"description": "Improper Authorization"
}
]
}
],
"affected": [
{
"vendor": "sigoden",
"product": "dufs",
"versions": [
{
"version": "0.1",
"status": "affected"
},
{
"version": "0.2",
"status": "affected"
},
{
"version": "0.3",
"status": "affected"
},
{
"version": "0.4",
"status": "affected"
},
{
"version": "0.5",
"status": "affected"
},
{
"version": "0.6",
"status": "affected"
},
{
"version": "0.7",
"status": "affected"
},
{
"version": "0.8",
"status": "affected"
},
{
"version": "0.9",
"status": "affected"
},
{
"version": "0.10",
"status": "affected"
},
{
"version": "0.11",
"status": "affected"
},
{
"version": "0.12",
"status": "affected"
},
{
"version": "0.13",
"status": "affected"
},
{
"version": "0.14",
"status": "affected"
},
{
"version": "0.15",
"status": "affected"
},
{
"version": "0.16",
"status": "affected"
},
{
"version": "0.17",
"status": "affected"
},
{
"version": "0.18",
"status": "affected"
},
{
"version": "0.19",
"status": "affected"
},
{
"version": "0.20",
"status": "affected"
},
{
"version": "0.21",
"status": "affected"
},
{
"version": "0.22",
"status": "affected"
},
{
"version": "0.23",
"status": "affected"
},
{
"version": "0.24",
"status": "affected"
},
{
"version": "0.25",
"status": "affected"
},
{
"version": "0.26",
"status": "affected"
},
{
"version": "0.27",
"status": "affected"
},
{
"version": "0.28",
"status": "affected"
},
{
"version": "0.29",
"status": "affected"
},
{
"version": "0.30",
"status": "affected"
},
{
"version": "0.31",
"status": "affected"
},
{
"version": "0.32",
"status": "affected"
},
{
"version": "0.33",
"status": "affected"
},
{
"version": "0.34",
"status": "affected"
},
{
"version": "0.35",
"status": "affected"
},
{
"version": "0.36",
"status": "affected"
},
{
"version": "0.37",
"status": "affected"
},
{
"version": "0.38",
"status": "affected"
},
{
"version": "0.39",
"status": "affected"
},
{
"version": "0.40",
"status": "affected"
},
{
"version": "0.41",
"status": "affected"
},
{
"version": "0.42",
"status": "affected"
},
{
"version": "0.43",
"status": "affected"
},
{
"version": "0.44",
"status": "affected"
},
{
"version": "0.45",
"status": "affected"
},
{
"version": "0.46.0",
"status": "affected"
},
{
"version": "0.47.0",
"status": "unaffected"
}
],
"cpes": [
"cpe:2.3:a:sigoden:dufs:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV COPY Operation Handler"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in sigoden dufs up to 0.46.0. This affects an unknown part of the file src/server.rs of the component WebDAV COPY Operation Handler. The manipulation leads to incorrect authorization. The attack is possible to be carried out remotely. Upgrading to version 0.47.0 is able to mitigate this issue. The identifier of the patch is fba13dffb9c65b5e5e26419f64de709200277a04. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 6.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:44:52.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "alexandrealvees (VulDB User)",
"type": "reporter"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437418",
"name": "VDB-437418 | sigoden dufs WebDAV COPY Operation server.rs authorization",
"tags": [
"vdb-entry"
]
},
{
"url": "https://vuldb.com/vuln/437418/cti",
"name": "VDB-437418 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129355",
"name": "CVE-2026-129355 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1043822",
"name": "Submit #1043822 | sigoden dufs 0.12.1 - 0.46.0 Improper Authorization Copiar",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/sigoden/dufs/commit/fba13dffb9c65b5e5e26419f64de709200277a04",
"tags": [
"patch"
]
},
{
"url": "https://github.com/sigoden/dufs/pull/753",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/sigoden/dufs/",
"tags": [
"product"
]
}
],
"tags": [
"x_open-source"
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/129xxx/CVE-2026-129356.json
+193
View File
@@ -0,0 +1,193 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129356",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:42:47.336Z",
"datePublished": "2026-11-15T01:15:24.018Z",
"dateUpdated": "2026-11-15T01:15:24.018Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-15T01:15:24.018Z"
},
"title": "vllm-project vllm Common Prefix single_type_kv_cache_manager.py race condition",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-362",
"lang": "en",
"description": "Race Condition"
}
]
}
],
"affected": [
{
"vendor": "vllm-project",
"product": "vllm",
"versions": [
{
"version": "0.30.0",
"status": "affected"
},
{
"version": "0.31.0",
"status": "affected"
},
{
"version": "0.32.0",
"status": "unaffected"
}
],
"cpes": [
"cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"
],
"modules": [
"Common Prefix Handler"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in vllm-project vllm 0.30.0/0.31.0. This vulnerability affects unknown code of the file single_type_kv_cache_manager.py of the component Common Prefix Handler. The manipulation results in race condition. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 0.32.0 is able to resolve this issue. The patch is identified as e687a251bb056fa527846633f7a1b0a6c0f42374. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 2.3,
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "LOW"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 5,
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 4.6,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:47:52.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "Zyz3366 (VulDB User)",
"type": "reporter"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437419",
"name": "VDB-437419 | vllm-project vllm Common Prefix single_type_kv_cache_manager.py race condition",
"tags": [
"vdb-entry"
]
},
{
"url": "https://vuldb.com/vuln/437419/cti",
"name": "VDB-437419 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129356",
"name": "CVE-2026-129356 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1043823",
"name": "Submit #1043823 | vLLM Project vLLM v0.30.0, v0.31.0 Improper Resource Management",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/vllm-project/vllm/issues/61673",
"tags": [
"exploit",
"issue-tracking"
]
},
{
"url": "https://github.com/vllm-project/vllm/pull/61126",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/vllm-project/vllm/commit/e687a251bb056fa527846633f7a1b0a6c0f42374",
"tags": [
"patch"
]
},
{
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.32.0",
"tags": [
"patch"
]
},
{
"url": "https://github.com/vllm-project/vllm/",
"tags": [
"product"
]
}
],
"tags": [
"x_open-source"
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/129xxx/CVE-2026-129454.json
+148
View File
@@ -0,0 +1,148 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129454",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-14T19:03:25.715Z",
"datePublished": "2026-11-15T01:49:37.777Z",
"dateUpdated": "2026-11-15T01:49:37.777Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-15T01:49:37.777Z"
},
"datePublic": "2026-11-14T00:00:00.000Z",
"title": "Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "izhaorui",
"product": "Zr.Admin.NET",
"defaultStatus": "unaffected",
"versions": [
{
"version": "85cff6ae22389c241d3a4efe178273966650f7ca",
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"versionType": "git"
}
],
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Controllers/WfFlowInstanceController.cs#L49-L57",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Service/WfFlowInstanceService.cs#L173-L176",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/commit/85cff6ae22389c241d3a4efe178273966650f7ca",
"tags": [
"technical-description",
"patch"
]
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-85cff6a-through-eb9228a-idor-via-workflow-instance-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/129xxx/CVE-2026-129455.json
+141
View File
@@ -0,0 +1,141 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129455",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-14T19:03:26.080Z",
"datePublished": "2026-11-15T01:49:37.095Z",
"dateUpdated": "2026-11-15T01:49:37.095Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-15T01:49:37.095Z"
},
"datePublic": "2026-11-14T00:00:00.000Z",
"title": "Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "izhaorui",
"product": "Zr.Admin.NET",
"defaultStatus": "unaffected",
"versions": [
{
"version": "e6ceaf47548f1a485f3ba3f4c139905e90fee0a2",
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"versionType": "git"
}
],
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/Content/FrontArticleController.cs#L122-L148",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Service/Content/ArticleService.cs#L402-L437",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-e6ceaf4-through-eb9228a-idor-via-front-article-api"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/129xxx/CVE-2026-129464.json
+148
View File
@@ -0,0 +1,148 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129464",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-15T01:02:25.540Z",
"datePublished": "2026-11-15T01:49:36.388Z",
"dateUpdated": "2026-11-15T01:49:36.388Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-15T01:49:36.388Z"
},
"datePublic": "2026-11-14T00:00:00.000Z",
"title": "Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "izhaorui",
"product": "Zr.Admin.NET",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0ee1ab8af5e3861766746d25acba1184111befcb",
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"versionType": "git"
}
],
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/CommonController.cs#L220-L241",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/Infrastructure/Controllers/BaseController.cs#L110-L119",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/commit/0ee1ab8af5e3861766746d25acba1184111befcb",
"tags": [
"technical-description",
"patch"
]
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-0ee1ab8-through-eb9228a-path-traversal-via-downloadfile"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/129xxx/CVE-2026-129465.json
+154
View File
@@ -0,0 +1,154 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129465",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-15T01:02:25.916Z",
"datePublished": "2026-11-15T01:49:35.675Z",
"dateUpdated": "2026-11-15T01:49:35.675Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-15T01:49:35.675Z"
},
"datePublic": "2026-11-14T00:00:00.000Z",
"title": "Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "izhaorui",
"product": "Zr.Admin.NET",
"defaultStatus": "unaffected",
"versions": [
{
"version": "af07ffc5d18e7876d3780d1ff5ee776b80950399",
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"versionType": "git"
}
],
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysProfileController.cs#L62-L75",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.ServiceCore/Services/SysUserService.cs#L220-L236",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysLoginController.cs#L516-L559",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/commit/af07ffc5d18e7876d3780d1ff5ee776b80950399",
"tags": [
"technical-description",
"patch"
]
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-af07ffc-through-eb9228a-idor-via-system-user-profile"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/129xxx/CVE-2026-129466.json
+147
View File
@@ -0,0 +1,147 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129466",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-15T01:02:26.292Z",
"datePublished": "2026-11-15T01:49:34.951Z",
"dateUpdated": "2026-11-15T01:49:34.951Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-15T01:49:34.951Z"
},
"datePublic": "2026-11-14T00:00:00.000Z",
"title": "Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "izhaorui",
"product": "Zr.Admin.NET",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1845017b67b3de3d12fad0238f5493235f70a93d",
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"versionType": "git"
}
],
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L145-L157",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L84-L120",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksLogController.cs#L31-L46",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-1845017-through-eb9228a-missing-authorization-via-system-tasks-get"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/33xxx/CVE-2026-33818.json
+2 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Go",
"dateReserved": "2026-03-23T20:35:32.815Z",
"datePublished": "2026-08-13T21:58:52.821Z",
"dateUpdated": "2026-11-14T17:21:48.076Z"
"dateUpdated": "2026-11-14T23:23:03.752Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go",
"dateUpdated": "2026-11-14T17:21:48.076Z"
"dateUpdated": "2026-11-14T23:23:03.752Z"
},
"title": "Enforce maximum recursion depth in encoding/asn1",
"descriptions": [
data/2026/42xxx/CVE-2026-42504.json
+2 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Go",
"dateReserved": "2026-04-28T00:21:12.792Z",
"datePublished": "2026-06-02T22:01:37.219Z",
"dateUpdated": "2026-11-14T17:21:46.541Z"
"dateUpdated": "2026-11-14T23:23:02.204Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go",
"dateUpdated": "2026-11-14T17:21:46.541Z"
"dateUpdated": "2026-11-14T23:23:02.204Z"
},
"title": "Quadratic complexity in WordDecoder.DecodeHeader in mime",
"descriptions": [
data/delta.json
+26 -20
View File
@@ -1,32 +1,38 @@
{
"fetchTime": "2026-11-14T21:11:09.439Z",
"numberOfChanges": 4,
"new": [],
"updated": [
"fetchTime": "2026-11-15T01:53:18.982Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2011-10042",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2011-10042",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2011/10xxx/CVE-2011-10042.json",
"dateUpdated": "2026-11-14T21:04:51.716Z"
"cveId": "CVE-2026-129454",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129454",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129454.json",
"dateUpdated": "2026-11-15T01:49:37.777Z"
},
{
"cveId": "CVE-2026-124030",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124030",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124030.json",
"dateUpdated": "2026-11-14T21:04:52.638Z"
"cveId": "CVE-2026-129455",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129455",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129455.json",
"dateUpdated": "2026-11-15T01:49:37.095Z"
},
{
"cveId": "CVE-2026-124031",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124031",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124031.json",
"dateUpdated": "2026-11-14T21:04:53.559Z"
"cveId": "CVE-2026-129464",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129464",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129464.json",
"dateUpdated": "2026-11-15T01:49:36.388Z"
},
{
"cveId": "CVE-2026-128240",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128240",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128240.json",
"dateUpdated": "2026-11-14T21:04:54.511Z"
"cveId": "CVE-2026-129465",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129465",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129465.json",
"dateUpdated": "2026-11-15T01:49:35.675Z"
},
{
"cveId": "CVE-2026-129466",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129466",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129466.json",
"dateUpdated": "2026-11-15T01:49:34.951Z"
}
],
"updated": [],
"error": []
}
data/deltaLog.json
+176 -29525
View File
File diff suppressed because it is too large. Load diff