CVE sync 2026-11-12T21:31:24Z
This commit is contained in:
Vulnerability Bot committed
1 parent
f9aa29d28e
commit
5791b57685
43 files changed
+3567
-13815
No files matched your search
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2025-10-23T08:45:11.715Z",
|
||||
"datePublished": "2026-11-10T19:20:09.823Z",
|
||||
"dateUpdated": "2026-11-10T19:20:09.823Z"
|
||||
"dateUpdated": "2026-11-12T20:38:06.689Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-489",
|
||||
"lang": "en",
|
||||
"description": "CWE-489 Active Debug Code"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 8.4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "HIGH",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:38:03.568064Z",
|
||||
"id": "CVE-2026-0169",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:38:06.689Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-05T14:20:09.312Z",
|
||||
"datePublished": "2026-11-07T04:31:15.410Z",
|
||||
"dateUpdated": "2026-11-07T04:31:15.410Z"
|
||||
"dateUpdated": "2026-11-12T20:20:19.618Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,40 @@
|
||||
}
|
||||
],
|
||||
"title": "Multiple Vulnerabilities in IBM API Connect"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:11:04.981852Z",
|
||||
"id": "CVE-2026-105459",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:20:19.618Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,119 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-106018",
|
||||
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "jci",
|
||||
"dateReserved": "2026-10-06T12:44:52.563Z",
|
||||
"datePublished": "2026-11-12T20:50:42.994Z",
|
||||
"dateUpdated": "2026-11-12T20:50:42.994Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
|
||||
"shortName": "jci",
|
||||
"dateUpdated": "2026-11-12T20:50:42.994Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-288",
|
||||
"description": "CWE-288 Authentication bypass using an alternate path or channel",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-115",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-115 Authentication Bypass"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Johnson Controls",
|
||||
"product": "EasyIO FW",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThanOrEqual": "3.0b25",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.\n\nThis issue affects EasyIO FW: through 3.0b25.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.<p>This issue affects EasyIO FW: through 3.0b25.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "ACTIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "HIGH",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "HIGH",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "HIGH",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.7,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "apache",
|
||||
"dateReserved": "2026-10-30T12:32:13.904Z",
|
||||
"datePublished": "2026-11-11T14:54:08.155Z",
|
||||
"dateUpdated": "2026-11-12T09:30:48.936Z"
|
||||
"dateUpdated": "2026-11-12T20:56:56.991Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -118,7 +118,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-12T09:30:48.936Z"
|
||||
"dateUpdated": "2026-11-12T20:56:56.991Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
@@ -138,6 +138,9 @@
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/AlmaLinux/updates/issues/4252"
|
||||
},
|
||||
{
|
||||
"url": "https://ubuntu.com/security/CVE-2026-119618"
|
||||
}
|
||||
],
|
||||
"title": "CVE Program Container",
|
||||
|
||||
@@ -0,0 +1,115 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126205",
|
||||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-10T20:07:44.958Z",
|
||||
"datePublished": "2026-11-12T20:41:25.574Z",
|
||||
"dateUpdated": "2026-11-12T20:41:25.574Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Loofah: Regular expression denial of service in the SVG local-reference check",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-400",
|
||||
"lang": "en",
|
||||
"description": "CWE-400: Uncontrolled Resource Consumption",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-1333",
|
||||
"lang": "en",
|
||||
"description": "CWE-1333: Inefficient Regular Expression Complexity",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q",
|
||||
"tags": [
|
||||
"x_refsource_CONFIRM"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/pull/324",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/pull/324"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/commit/2f31e7fae36036c9882d3d0fae720e1014c57cd1",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/commit/2f31e7fae36036c9882d3d0fae720e1014c57cd1"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "flavorjones",
|
||||
"product": "loofah",
|
||||
"versions": [
|
||||
{
|
||||
"version": "< 2.25.3",
|
||||
"status": "affected"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"shortName": "GitHub_M",
|
||||
"dateUpdated": "2026-11-12T20:41:25.574Z"
|
||||
},
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVG_ALLOW_LOCAL_HREF with a regular expression whose line anchor and newline-matching whitespace cause an all-whitespace value to be rescanned from every line start. An attacker can submit an SVG reference element with a long multiline-whitespace attribute and consume CPU quadratically during sanitization. CRuby 3.1 and earlier and JRuby are affected, while CRuby 3.2 and later uses linear-time regular-expression matching. The default safelist reaches the vulnerable check without a configuration change. This issue is fixed in version 2.25.3."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "GHSA-mf2j-8f84-cc9q",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,118 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126206",
|
||||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-10T20:07:44.958Z",
|
||||
"datePublished": "2026-11-12T20:51:36.537Z",
|
||||
"dateUpdated": "2026-11-12T20:51:36.537Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Loofah allowed_uri? treats data:text/html as safe text/plain",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-79",
|
||||
"lang": "en",
|
||||
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-184",
|
||||
"lang": "en",
|
||||
"description": "CWE-184: Incomplete List of Disallowed Inputs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "PASSIVE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subConfidentialityImpact": "LOW",
|
||||
"subIntegrityImpact": "LOW",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
|
||||
"version": "4.0"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f",
|
||||
"tags": [
|
||||
"x_refsource_CONFIRM"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/pull/324",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/pull/324"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "flavorjones",
|
||||
"product": "loofah",
|
||||
"versions": [
|
||||
{
|
||||
"version": "= 2.25.2",
|
||||
"status": "affected"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"shortName": "GitHub_M",
|
||||
"dateUpdated": "2026-11-12T20:51:36.537Z"
|
||||
},
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "GHSA-jcff-cj73-4w4f",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126207",
|
||||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-10T20:07:44.958Z",
|
||||
"datePublished": "2026-11-12T20:53:55.553Z",
|
||||
"dateUpdated": "2026-11-12T20:53:55.553Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Loofah: CSS url() sanitization bypass via escaped parentheses",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-180",
|
||||
"lang": "en",
|
||||
"description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-184",
|
||||
"lang": "en",
|
||||
"description": "CWE-184: Incomplete List of Disallowed Inputs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.7,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767",
|
||||
"tags": [
|
||||
"x_refsource_CONFIRM"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/pull/324",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/pull/324"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "flavorjones",
|
||||
"product": "loofah",
|
||||
"versions": [
|
||||
{
|
||||
"version": "< 2.25.3",
|
||||
"status": "affected"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"shortName": "GitHub_M",
|
||||
"dateUpdated": "2026-11-12T20:53:55.553Z"
|
||||
},
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "GHSA-m3x9-938q-5767",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126208",
|
||||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-10T20:07:44.958Z",
|
||||
"datePublished": "2026-11-12T20:59:48.651Z",
|
||||
"dateUpdated": "2026-11-12T20:59:48.651Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-178",
|
||||
"lang": "en",
|
||||
"description": "CWE-178: Improper Handling of Case Sensitivity",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-184",
|
||||
"lang": "en",
|
||||
"description": "CWE-184: Incomplete List of Disallowed Inputs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.7,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-345x-3rq2-jfrm",
|
||||
"tags": [
|
||||
"x_refsource_CONFIRM"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-345x-3rq2-jfrm"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/pull/324",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/pull/324"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/commit/cdd6ff7fb51998eb181bd2da925ddbcfcc8a3b96",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/commit/cdd6ff7fb51998eb181bd2da925ddbcfcc8a3b96"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "flavorjones",
|
||||
"product": "loofah",
|
||||
"versions": [
|
||||
{
|
||||
"version": "< 2.25.3",
|
||||
"status": "affected"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"shortName": "GitHub_M",
|
||||
"dateUpdated": "2026-11-12T20:59:48.651Z"
|
||||
},
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "GHSA-345x-3rq2-jfrm",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,118 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126209",
|
||||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-10T20:07:44.958Z",
|
||||
"datePublished": "2026-11-12T21:01:58.128Z",
|
||||
"dateUpdated": "2026-11-12T21:01:58.128Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Loofah allowed_uri? treats javascript: alert(1) as safe",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-79",
|
||||
"lang": "en",
|
||||
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-184",
|
||||
"lang": "en",
|
||||
"description": "CWE-184: Incomplete List of Disallowed Inputs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "PASSIVE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subConfidentialityImpact": "LOW",
|
||||
"subIntegrityImpact": "LOW",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
|
||||
"version": "4.0"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-p9wj-w8xq-vjx6",
|
||||
"tags": [
|
||||
"x_refsource_CONFIRM"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-p9wj-w8xq-vjx6"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/pull/324",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/pull/324"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/commit/62c04841e8252a1b5373afcd2b89fb9b8279e317",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/commit/62c04841e8252a1b5373afcd2b89fb9b8279e317"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3",
|
||||
"tags": [
|
||||
"x_refsource_MISC"
|
||||
],
|
||||
"url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "flavorjones",
|
||||
"product": "loofah",
|
||||
"versions": [
|
||||
{
|
||||
"version": ">= 2.25.0, < 2.25.3",
|
||||
"status": "affected"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||||
"shortName": "GitHub_M",
|
||||
"dateUpdated": "2026-11-12T21:01:58.128Z"
|
||||
},
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.allowed_uri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing where the reference ends and hiding a javascript: or vbscript: scheme that a browser reconstructs. The bypass applies to encoded colons and encoded scheme letters when a stripped character terminates the numeric reference. An application that renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting, and Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes entities before URI evaluation. This issue is fixed in version 2.25.3."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "GHSA-p9wj-w8xq-vjx6",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,178 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126793",
|
||||
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "AMZN",
|
||||
"dateReserved": "2026-11-11T19:28:09.253Z",
|
||||
"datePublished": "2026-11-12T21:04:58.312Z",
|
||||
"dateUpdated": "2026-11-12T21:08:04.746Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
|
||||
"shortName": "AMZN",
|
||||
"dateUpdated": "2026-11-12T21:08:04.746Z"
|
||||
},
|
||||
"title": "Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-426",
|
||||
"description": "CWE-426 Untrusted search path",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-233",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-233 Privilege Escalation"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "AWS",
|
||||
"product": "aws-advanced-go-wrapper",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "2026-04-06",
|
||||
"lessThan": "2026-07-29",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:aws:aws-advanced-go-wrapper:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "2026-04-06",
|
||||
"versionEndExcluding": "2026-07-29"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.\n\n\n\nTo remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper.</p><p>To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-07-29",
|
||||
"tags": [
|
||||
"release-notes",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://aws.amazon.com/security/security-bulletins/2026-182-aws/",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-fhr2-6r5v-gm9f",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "PASSIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.6,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 0.5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-127206",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T16:30:10.903Z",
|
||||
"datePublished": "2026-11-12T20:41:54.273Z",
|
||||
"dateUpdated": "2026-11-12T20:41:54.273Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T20:41:54.273Z"
|
||||
},
|
||||
"title": "Image CAPTCHA for Contact Form 7 and WPForms 3.3.29 CAPTCHA Bypass",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA."
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"datePublic": "2026-11-10T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Guessable CAPTCHA",
|
||||
"cweId": "CWE-804",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "hookandhook",
|
||||
"product": "Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR)",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThanOrEqual": "3.3.29"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.9,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://hackmd.io/@buiih/S1pRnCeCfl",
|
||||
"name": "Researcher Disclosure",
|
||||
"tags": [
|
||||
"technical-description",
|
||||
"exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://wordpress.org/plugins/contact-form-7-image-captcha/",
|
||||
"name": "WordPress Plugin",
|
||||
"tags": [
|
||||
"product"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/image-captcha-for-contact-form-7-and-wpforms-captcha-bypass",
|
||||
"name": "VulnCheck Advisory: Image CAPTCHA for Contact Form 7 and WPForms 3.3.29 CAPTCHA Bypass",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "buiih",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-127207",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T16:30:10.903Z",
|
||||
"datePublished": "2026-11-12T20:48:13.864Z",
|
||||
"dateUpdated": "2026-11-12T20:48:13.864Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T20:48:13.864Z"
|
||||
},
|
||||
"title": "Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760."
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"datePublic": "2026-11-10T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Missing Authorization",
|
||||
"cweId": "CWE-862",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "Sendcloud",
|
||||
"product": "Sendcloud for WooCommerce: Automated Shipping, Branded Tracking & Returns",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThanOrEqual": "1.0.41"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "LOW",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://hackmd.io/@buiih/HJ39N1-0Mx",
|
||||
"name": "Researcher Disclosure",
|
||||
"tags": [
|
||||
"technical-description",
|
||||
"exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://wordpress.org/plugins/sendcloud-connected-shipping/",
|
||||
"name": "WordPress Plugin",
|
||||
"tags": [
|
||||
"product"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/sendcloud-for-woocommerce-missing-authorization-via-ajax-actions",
|
||||
"name": "VulnCheck Advisory: Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "buiih",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,154 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-127208",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T16:30:10.903Z",
|
||||
"datePublished": "2026-11-12T20:58:59.634Z",
|
||||
"dateUpdated": "2026-11-12T20:58:59.634Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T20:58:59.634Z"
|
||||
},
|
||||
"title": "datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotation",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse_python_type_annotation and _python_type_expr_from_ast. Attackers can embed malicious Python expressions such as __import__ calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model_rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime."
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
],
|
||||
"datePublic": "2026-09-24T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Improper Control of Generation of Code ('Code Injection')",
|
||||
"cweId": "CWE-94",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "datamodel-code-generator",
|
||||
"product": "datamodel-code-generator",
|
||||
"packageURL": "pkg:pypi/datamodel-code-generator",
|
||||
"repo": "https://github.com/datamodel-code-generator/datamodel-code-generator",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThan": "0.84.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "ACTIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.6,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.84.0",
|
||||
"name": "Release Notes",
|
||||
"tags": [
|
||||
"release-notes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/datamodel-code-generator/datamodel-code-generator/commit/ebfc11d0644d37a71374b28aac06d98748e584ec",
|
||||
"name": "Patch Commit",
|
||||
"tags": [
|
||||
"patch",
|
||||
"issue-tracking"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-x-python-type-annotation",
|
||||
"name": "VulnCheck Advisory: datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotation",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Enrik Mustafa",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-127209",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T16:30:10.903Z",
|
||||
"datePublished": "2026-11-12T21:18:18.139Z",
|
||||
"dateUpdated": "2026-11-12T21:18:18.139Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-12T21:18:18.139Z"
|
||||
},
|
||||
"title": "Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction."
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-10T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
||||
"cweId": "CWE-22",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "Xiaomi",
|
||||
"product": "Mi Browser (com.mi.globalbrowser)",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThan": "14.66.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "LOW",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.1,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 4,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/actuator/cve/blob/main/Xiaomi/2026.07.09%20CVD%20-%20Xiaomi%20Mi%20Browser.md",
|
||||
"name": "Researcher Disclosure",
|
||||
"tags": [
|
||||
"technical-description",
|
||||
"exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/xiaomi-mi-browser-path-traversal-via-thirddocvieweractivity",
|
||||
"name": "VulnCheck Advisory: Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Edward \"Actuator\" Warren",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-07-17T15:50:21.345Z",
|
||||
"datePublished": "2026-07-17T19:44:40.562Z",
|
||||
"dateUpdated": "2026-11-11T12:58:11.638Z"
|
||||
"dateUpdated": "2026-11-12T20:41:24.268Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -128,6 +128,44 @@
|
||||
"cpe:/o:redhat:enterprise_linux:8::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "glib2",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:2.56.4-158.el8_6.8",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_aus:8.6::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "glib2",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:2.56.4-158.el8_6.8",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_aus:8.6::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
@@ -2348,6 +2386,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99864",
|
||||
"name": "RHSA-2026:99864",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-16118",
|
||||
"tags": [
|
||||
@@ -2408,7 +2454,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-11T12:58:11.638Z"
|
||||
"dateUpdated": "2026-11-12T20:41:24.268Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-07-23T02:09:11.096Z",
|
||||
"datePublished": "2026-11-07T04:31:20.554Z",
|
||||
"dateUpdated": "2026-11-07T04:31:20.554Z"
|
||||
"dateUpdated": "2026-11-12T20:20:03.856Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,40 @@
|
||||
}
|
||||
],
|
||||
"title": "Multiple Vulnerabilities in IBM API Connect"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:11:14.265592Z",
|
||||
"id": "CVE-2026-16711",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:20:03.856Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-07-24T06:55:39.341Z",
|
||||
"datePublished": "2026-11-07T04:31:34.219Z",
|
||||
"dateUpdated": "2026-11-07T04:31:34.219Z"
|
||||
"dateUpdated": "2026-11-12T20:19:47.670Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,40 @@
|
||||
}
|
||||
],
|
||||
"title": "Multiple Vulnerabilities in IBM API Connect"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:10:06.923467Z",
|
||||
"id": "CVE-2026-16918",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:19:47.670Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-07-24T13:59:46.730Z",
|
||||
"datePublished": "2026-11-07T04:31:42.187Z",
|
||||
"dateUpdated": "2026-11-07T04:31:42.187Z"
|
||||
"dateUpdated": "2026-11-12T20:19:30.419Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,40 @@
|
||||
}
|
||||
],
|
||||
"title": "Multiple Vulnerabilities in IBM API Connect"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:10:55.603122Z",
|
||||
"id": "CVE-2026-17067",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:19:30.419Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-07-24T14:41:01.202Z",
|
||||
"datePublished": "2026-11-07T04:31:44.145Z",
|
||||
"dateUpdated": "2026-11-07T04:31:44.145Z"
|
||||
"dateUpdated": "2026-11-12T20:19:14.953Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,40 @@
|
||||
}
|
||||
],
|
||||
"title": "Multiple Vulnerabilities in IBM API Connect"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:10:50.749844Z",
|
||||
"id": "CVE-2026-17085",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:19:14.953Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-07-24T17:21:04.486Z",
|
||||
"datePublished": "2026-11-07T04:31:58.744Z",
|
||||
"dateUpdated": "2026-11-07T04:31:58.744Z"
|
||||
"dateUpdated": "2026-11-12T20:18:59.583Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,40 @@
|
||||
}
|
||||
],
|
||||
"title": "Multiple Vulnerabilities in IBM API Connect"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:11:25.342218Z",
|
||||
"id": "CVE-2026-17143",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:18:59.583Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-07-24T19:53:32.344Z",
|
||||
"datePublished": "2026-11-07T04:32:14.245Z",
|
||||
"dateUpdated": "2026-11-07T04:32:14.245Z"
|
||||
"dateUpdated": "2026-11-12T20:18:44.102Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,40 @@
|
||||
}
|
||||
],
|
||||
"title": "Multiple Vulnerabilities in IBM API Connect"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:11:30.334594Z",
|
||||
"id": "CVE-2026-17214",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:18:44.102Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-06-23T16:15:23.845Z",
|
||||
"datePublished": "2026-11-10T19:20:53.771Z",
|
||||
"dateUpdated": "2026-11-10T19:20:53.771Z"
|
||||
"dateUpdated": "2026-11-12T20:20:32.549Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-693",
|
||||
"lang": "en",
|
||||
"description": "CWE-693 Protection Mechanism Failure"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 8.4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "HIGH",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:20:27.218733Z",
|
||||
"id": "CVE-2026-56951",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:20:32.549Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-06-23T16:16:45.565Z",
|
||||
"datePublished": "2026-11-10T19:20:55.690Z",
|
||||
"dateUpdated": "2026-11-10T19:20:55.690Z"
|
||||
"dateUpdated": "2026-11-12T20:21:32.513Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,56 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 8.4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "HIGH",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:21:12.370757Z",
|
||||
"id": "CVE-2026-56966",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:21:32.513Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-06-23T16:22:11.809Z",
|
||||
"datePublished": "2026-11-10T19:20:58.567Z",
|
||||
"dateUpdated": "2026-11-10T19:20:58.567Z"
|
||||
"dateUpdated": "2026-11-12T20:22:43.831Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-190",
|
||||
"lang": "en",
|
||||
"description": "CWE-190 Integer Overflow or Wraparound"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 8.4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "HIGH",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:22:40.278228Z",
|
||||
"id": "CVE-2026-56980",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:22:43.831Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-06-23T16:23:34.034Z",
|
||||
"datePublished": "2026-11-10T19:20:59.522Z",
|
||||
"dateUpdated": "2026-11-10T19:20:59.522Z"
|
||||
"dateUpdated": "2026-11-12T20:24:07.799Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-119",
|
||||
"lang": "en",
|
||||
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 6.7,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:24:03.550655Z",
|
||||
"id": "CVE-2026-56995",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:24:07.799Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-06-23T16:28:17.723Z",
|
||||
"datePublished": "2026-11-10T19:21:06.223Z",
|
||||
"dateUpdated": "2026-11-10T19:21:06.223Z"
|
||||
"dateUpdated": "2026-11-12T20:32:41.846Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-269",
|
||||
"lang": "en",
|
||||
"description": "CWE-269 Improper Privilege Management"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 8.4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "HIGH",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:32:38.501035Z",
|
||||
"id": "CVE-2026-57037",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:32:41.846Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-02T05:34:02.657Z",
|
||||
"datePublished": "2026-11-10T19:21:10.078Z",
|
||||
"dateUpdated": "2026-11-10T19:21:10.078Z"
|
||||
"dateUpdated": "2026-11-12T20:33:36.232Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-693",
|
||||
"lang": "en",
|
||||
"description": "CWE-693 Protection Mechanism Failure"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 6.8,
|
||||
"attackVector": "PHYSICAL",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:33:33.596381Z",
|
||||
"id": "CVE-2026-58677",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:33:36.232Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-02T05:38:24.955Z",
|
||||
"datePublished": "2026-11-10T19:21:18.937Z",
|
||||
"dateUpdated": "2026-11-10T19:21:18.937Z"
|
||||
"dateUpdated": "2026-11-12T20:34:23.115Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-119",
|
||||
"lang": "en",
|
||||
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 9.8,
|
||||
"attackVector": "NETWORK",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:34:18.915480Z",
|
||||
"id": "CVE-2026-58705",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:34:23.115Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:29:35.785Z",
|
||||
"datePublished": "2026-11-10T19:22:28.249Z",
|
||||
"dateUpdated": "2026-11-10T19:22:28.249Z"
|
||||
"dateUpdated": "2026-11-12T21:02:22.957Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-119",
|
||||
"lang": "en",
|
||||
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 2.3,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "LOW",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
|
||||
"integrityImpact": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"privilegesRequired": "HIGH",
|
||||
"confidentialityImpact": "LOW"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T21:02:20.380173Z",
|
||||
"id": "CVE-2026-59619",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T21:02:22.957Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:29:35.786Z",
|
||||
"datePublished": "2026-11-10T19:22:30.177Z",
|
||||
"dateUpdated": "2026-11-10T19:22:30.177Z"
|
||||
"dateUpdated": "2026-11-12T21:00:39.570Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-693",
|
||||
"lang": "en",
|
||||
"description": "CWE-693 Protection Mechanism Failure"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"integrityImpact": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "LOW"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T21:00:36.241037Z",
|
||||
"id": "CVE-2026-59624",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T21:00:39.570Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:29:35.786Z",
|
||||
"datePublished": "2026-11-10T19:22:31.230Z",
|
||||
"dateUpdated": "2026-11-10T19:22:31.230Z"
|
||||
"dateUpdated": "2026-11-12T21:00:00.588Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-787",
|
||||
"lang": "en",
|
||||
"description": "CWE-787 Out-of-bounds Write"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 9.8,
|
||||
"attackVector": "NETWORK",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:59:56.968244Z",
|
||||
"id": "CVE-2026-59625",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T21:00:00.588Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:29:35.786Z",
|
||||
"datePublished": "2026-11-10T19:22:32.189Z",
|
||||
"dateUpdated": "2026-11-10T19:22:32.189Z"
|
||||
"dateUpdated": "2026-11-12T20:49:20.153Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-416",
|
||||
"lang": "en",
|
||||
"description": "CWE-416 Use After Free"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 9.8,
|
||||
"attackVector": "NETWORK",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:49:17.164713Z",
|
||||
"id": "CVE-2026-59626",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:49:20.153Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:30:47.247Z",
|
||||
"datePublished": "2026-11-10T19:22:33.145Z",
|
||||
"dateUpdated": "2026-11-10T19:22:33.145Z"
|
||||
"dateUpdated": "2026-11-12T20:47:34.481Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-125",
|
||||
"lang": "en",
|
||||
"description": "CWE-125 Out-of-bounds Read"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"integrityImpact": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "LOW"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:47:29.886921Z",
|
||||
"id": "CVE-2026-59628",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:47:34.481Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:30:47.248Z",
|
||||
"datePublished": "2026-11-10T19:22:37.970Z",
|
||||
"dateUpdated": "2026-11-10T19:22:37.970Z"
|
||||
"dateUpdated": "2026-11-12T20:46:52.933Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-691",
|
||||
"lang": "en",
|
||||
"description": "CWE-691 Insufficient Control Flow Management"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 6.2,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||
"integrityImpact": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "NONE"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:46:27.628479Z",
|
||||
"id": "CVE-2026-59636",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:46:52.933Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:30:47.248Z",
|
||||
"datePublished": "2026-11-10T19:22:38.945Z",
|
||||
"dateUpdated": "2026-11-10T19:22:38.945Z"
|
||||
"dateUpdated": "2026-11-12T20:46:04.835Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-693",
|
||||
"lang": "en",
|
||||
"description": "CWE-693 Protection Mechanism Failure"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 3.3,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "LOW",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||
"integrityImpact": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"confidentialityImpact": "LOW"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:46:00.463685Z",
|
||||
"id": "CVE-2026-59637",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:46:04.835Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-86322",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-09-07T06:25:38.505Z",
|
||||
"datePublished": "2026-11-12T20:19:29.433Z",
|
||||
"dateUpdated": "2026-11-12T20:19:29.433Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Important",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Satellite 6",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "foreman",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:satellite:6"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-86322",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529289",
|
||||
"name": "RHBZ#2529289",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-12T18:48:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-639",
|
||||
"description": "Authorization Bypass Through User-Controlled Key",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key",
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-09-07T00:00:00.000Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-12T18:48:00.000Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This issue was discovered by Sandipan Roy (Red Hat)."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T20:19:29.433Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-86323",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-09-07T06:25:38.505Z",
|
||||
"datePublished": "2026-11-12T20:19:52.542Z",
|
||||
"dateUpdated": "2026-11-12T20:19:52.542Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Moderate",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Satellite 6",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "foreman",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:satellite:6"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-86323",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529290",
|
||||
"name": "RHBZ#2529290",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-12T18:49:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-639",
|
||||
"description": "Authorization Bypass Through User-Controlled Key",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key",
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-09-07T06:19:41.589Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-12T18:49:00.000Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This issue was discovered by Sandipan Roy (Red Hat) and Tej Rathi (Red Hat)."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T20:19:52.542Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-86324",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-09-07T06:25:38.505Z",
|
||||
"datePublished": "2026-11-12T20:19:57.526Z",
|
||||
"dateUpdated": "2026-11-12T20:19:57.526Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Moderate",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Satellite 6",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "foreman",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:satellite:6"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-86324",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529291",
|
||||
"name": "RHBZ#2529291",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-12T18:50:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-639",
|
||||
"description": "Authorization Bypass Through User-Controlled Key",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key",
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-09-07T06:19:41.591Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-12T18:50:00.000Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This issue was discovered by Sandipan Roy (Red Hat) and Tej Rathi (Red Hat)."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T20:19:57.526Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-91141",
|
||||
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "certcc",
|
||||
"dateReserved": "2026-09-14T20:30:18.834Z",
|
||||
"datePublished": "2026-11-12T21:13:23.814Z",
|
||||
"dateUpdated": "2026-11-12T21:13:23.814Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "CVE-2026-91141",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "COVESA",
|
||||
"product": "vSomeIp",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "v3.6.1",
|
||||
"lessThan": "3.7.4",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "CWE-1284"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "CWE-789"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "CWE-400"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://kb.cert.org/vuls/id/128947"
|
||||
},
|
||||
{
|
||||
"url": "https://biackr0se.github.io/posts/cve-2026-91141-vsomeip/"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "VINCE 4.0.3",
|
||||
"env": "prod",
|
||||
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-91141"
|
||||
},
|
||||
"providerMetadata": {
|
||||
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
|
||||
"shortName": "certcc",
|
||||
"dateUpdated": "2026-11-12T21:13:23.814Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-09-22T05:59:06.219Z",
|
||||
"datePublished": "2026-11-10T19:22:48.226Z",
|
||||
"dateUpdated": "2026-11-10T19:22:48.226Z"
|
||||
"dateUpdated": "2026-11-12T20:45:25.687Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -54,6 +54,68 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-119",
|
||||
"lang": "en",
|
||||
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"scope": "UNCHANGED",
|
||||
"version": "3.1",
|
||||
"baseScore": 8.4,
|
||||
"attackVector": "LOCAL",
|
||||
"baseSeverity": "HIGH",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"integrityImpact": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"attackComplexity": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"confidentialityImpact": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T20:45:19.036883Z",
|
||||
"id": "CVE-2026-95405",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T20:45:25.687Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
+12
-240
@@ -1,248 +1,20 @@
|
||||
{
|
||||
"fetchTime": "2026-11-12T20:18:44.130Z",
|
||||
"numberOfChanges": 40,
|
||||
"new": [],
|
||||
"updated": [
|
||||
"fetchTime": "2026-11-12T21:18:31.808Z",
|
||||
"numberOfChanges": 2,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2024-41786",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-41786",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/41xxx/CVE-2024-41786.json",
|
||||
"dateUpdated": "2026-11-12T20:16:34.149Z"
|
||||
"cveId": "CVE-2026-127209",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127209",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127209.json",
|
||||
"dateUpdated": "2026-11-12T21:18:18.139Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-102618",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102618",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102618.json",
|
||||
"dateUpdated": "2026-11-12T20:16:15.789Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-107331",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107331",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107331.json",
|
||||
"dateUpdated": "2026-11-12T20:13:42.873Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-112369",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112369",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112369.json",
|
||||
"dateUpdated": "2026-11-12T20:15:57.671Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-118904",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118904",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118904.json",
|
||||
"dateUpdated": "2026-11-12T20:13:29.585Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-120113",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120113",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120113.json",
|
||||
"dateUpdated": "2026-11-12T20:13:42.715Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-14377",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-14377",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14377.json",
|
||||
"dateUpdated": "2026-11-12T20:15:40.295Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-14963",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-14963",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14963.json",
|
||||
"dateUpdated": "2026-11-12T20:15:22.628Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-16433",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-16433",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16433.json",
|
||||
"dateUpdated": "2026-11-12T20:15:06.131Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-16880",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-16880",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16880.json",
|
||||
"dateUpdated": "2026-11-12T20:13:45.333Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17230",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17230",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17230.json",
|
||||
"dateUpdated": "2026-11-12T20:13:45.181Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17231",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17231",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17231.json",
|
||||
"dateUpdated": "2026-11-12T20:18:28.737Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17232",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17232",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17232.json",
|
||||
"dateUpdated": "2026-11-12T20:18:13.247Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17237",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17237",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17237.json",
|
||||
"dateUpdated": "2026-11-12T20:13:44.989Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17238",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17238",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17238.json",
|
||||
"dateUpdated": "2026-11-12T20:13:44.844Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17244",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17244",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17244.json",
|
||||
"dateUpdated": "2026-11-12T20:13:44.691Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17288",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17288",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17288.json",
|
||||
"dateUpdated": "2026-11-12T20:13:44.546Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17294",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17294",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17294.json",
|
||||
"dateUpdated": "2026-11-12T20:13:44.399Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17298",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17298",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17298.json",
|
||||
"dateUpdated": "2026-11-12T20:13:44.254Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17305",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17305",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17305.json",
|
||||
"dateUpdated": "2026-11-12T20:13:44.104Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17357",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17357",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17357.json",
|
||||
"dateUpdated": "2026-11-12T20:17:55.620Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17367",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17367",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17367.json",
|
||||
"dateUpdated": "2026-11-12T20:13:43.948Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17369",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17369",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17369.json",
|
||||
"dateUpdated": "2026-11-12T20:17:40.386Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17372",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17372",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17372.json",
|
||||
"dateUpdated": "2026-11-12T20:17:23.510Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17377",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17377",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17377.json",
|
||||
"dateUpdated": "2026-11-12T20:17:06.714Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17379",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17379",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17379.json",
|
||||
"dateUpdated": "2026-11-12T20:16:51.057Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17382",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17382",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17382.json",
|
||||
"dateUpdated": "2026-11-12T20:13:43.794Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17385",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17385",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17385.json",
|
||||
"dateUpdated": "2026-11-12T20:13:43.634Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17396",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17396",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17396.json",
|
||||
"dateUpdated": "2026-11-12T20:13:43.486Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17397",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17397",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17397.json",
|
||||
"dateUpdated": "2026-11-12T20:13:43.335Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17405",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17405",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17405.json",
|
||||
"dateUpdated": "2026-11-12T20:13:43.191Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17406",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17406",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17406.json",
|
||||
"dateUpdated": "2026-11-12T20:13:43.032Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-18194",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18194",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18194.json",
|
||||
"dateUpdated": "2026-11-12T20:14:50.104Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-18546",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18546",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18546.json",
|
||||
"dateUpdated": "2026-11-12T20:14:33.967Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-2477",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-2477",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2477.json",
|
||||
"dateUpdated": "2026-11-12T20:14:17.888Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-56910",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-56910",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/56xxx/CVE-2026-56910.json",
|
||||
"dateUpdated": "2026-11-12T20:16:21.520Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-56930",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-56930",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/56xxx/CVE-2026-56930.json",
|
||||
"dateUpdated": "2026-11-12T20:18:12.890Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-77153",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-77153",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77153.json",
|
||||
"dateUpdated": "2026-11-12T20:14:01.855Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-81542",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81542",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81542.json",
|
||||
"dateUpdated": "2026-11-12T20:13:45.800Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-84237",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84237",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84237.json",
|
||||
"dateUpdated": "2026-11-12T20:13:42.556Z"
|
||||
"cveId": "CVE-2026-91141",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91141",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91141.json",
|
||||
"dateUpdated": "2026-11-12T21:13:23.814Z"
|
||||
}
|
||||
],
|
||||
"updated": [],
|
||||
"error": []
|
||||
}
|
||||
+309
-13522
File diff suppressed because it is too large.
Load diff
Reference in new issue
Block a user