VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-13T10:30:40Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-13 11:30:46 +01:00
1 parent 71a8a15037
commit 5cb9173b05
338 files changed
+52412 -646
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2023/54xxx/CVE-2023-54423.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-54423",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:47:05.179Z",
"datePublished": "2026-11-13T09:37:04.518Z",
"dateUpdated": "2026-11-13T09:37:04.518Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:37:04.518Z"
},
"datePublic": "2023-12-08T00:00:00.000Z",
"title": "OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor",
"descriptions": [
{
"lang": "en",
"value": "OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Script in Attributes of IMG Tags in a Web Page",
"cweId": "CWE-82",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "OpenMage",
"product": "magento-lts",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "20.2.0"
},
{
"version": "20.2.0",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9j5w-2cqc-cwj9",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-9j5w-2cqc-cwj9)"
},
{
"name": "VulnCheck Advisory: OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.2.0-stored-xss-via-tinymce-wysiwyg-editor"
}
],
"credits": [
{
"lang": "en",
"value": "halitAKAYDIN",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2024/58xxx/CVE-2024-58404.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-58404",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:59:33.492Z",
"datePublished": "2026-11-13T09:37:03.888Z",
"dateUpdated": "2026-11-13T09:37:03.888Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:37:03.888Z"
},
"datePublic": "2024-09-12T00:00:00.000Z",
"title": "Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
"descriptions": [
{
"lang": "en",
"value": "Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "diced",
"product": "zipline",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.4.5",
"status": "affected",
"versionType": "semver",
"lessThan": "3.7.10"
},
{
"version": "3.7.10",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "diced",
"product": "zipline",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.4.5",
"status": "affected",
"versionType": "semver",
"lessThan": "3.7.10"
},
{
"version": "3.7.10",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.3,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-v38v-92cm-6mx8)"
},
{
"name": "VulnCheck Advisory: Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "piprett",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2024/58xxx/CVE-2024-58405.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-58405",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:59:38.607Z",
"datePublished": "2026-11-13T09:37:03.249Z",
"dateUpdated": "2026-11-13T09:37:03.249Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:37:03.249Z"
},
"datePublic": "2024-03-05T00:00:00.000Z",
"title": "Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "diced",
"product": "zipline",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "3.7.9"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-j2cw-9fvc-wr4r)"
},
{
"name": "VulnCheck Advisory: Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "resetd3v",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2025/71xxx/CVE-2025-71459.json
+123
View File
@@ -0,0 +1,123 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-71459",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:58:40.540Z",
"datePublished": "2026-11-13T09:37:02.598Z",
"dateUpdated": "2026-11-13T09:37:02.598Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:37:02.598Z"
},
"datePublic": "2025-12-15T00:00:00.000Z",
"title": "Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "diced",
"product": "zipline",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "4.3.2"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-4jm6-mgwv-fq63)"
},
{
"name": "VulnCheck Advisory: Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header"
}
],
"credits": [
{
"lang": "en",
"value": "DenizParlak",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2025/71xxx/CVE-2025-71460.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-71460",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:59:01.582Z",
"datePublished": "2026-11-13T09:37:01.929Z",
"dateUpdated": "2026-11-13T09:37:01.929Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:37:01.929Z"
},
"datePublic": "2025-08-08T00:00:00.000Z",
"title": "Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "diced",
"product": "zipline",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "4.2.1"
},
{
"version": "4.2.1",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"references": [
{
"url": "https://github.com/diced/zipline/security/advisories/GHSA-26wv-mhc3-5xfq",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-26wv-mhc3-5xfq)"
},
{
"name": "VulnCheck Advisory: Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.2.1-missing-ownership-check-via-api-user-files-transaction"
}
],
"credits": [
{
"lang": "en",
"value": "smashedr",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2025/71xxx/CVE-2025-71461.json
+114
View File
@@ -0,0 +1,114 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-71461",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:59:05.981Z",
"datePublished": "2026-11-13T09:37:01.263Z",
"dateUpdated": "2026-11-13T09:37:01.263Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:37:01.263Z"
},
"datePublic": "2025-03-19T00:00:00.000Z",
"title": "Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"cweId": "CWE-338",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "diced",
"product": "zipline",
"defaultStatus": "unaffected"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-6rg9-q9ww-w2rw)"
},
{
"name": "VulnCheck Advisory: Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"
}
],
"credits": [
{
"lang": "en",
"value": "allc",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2025/71xxx/CVE-2025-71462.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-71462",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:59:26.621Z",
"datePublished": "2026-11-13T09:37:00.586Z",
"dateUpdated": "2026-11-13T09:37:00.586Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:37:00.586Z"
},
"datePublic": "2025-01-31T00:00:00.000Z",
"title": "Zipline before 3.7.12 XSS via url parameter on login page",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "diced",
"product": "zipline",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.7.12"
},
{
"version": "3.7.12",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-m288-p6wr-m6gv)"
},
{
"name": "VulnCheck Advisory: Zipline before 3.7.12 XSS via url parameter on login page",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2025/71xxx/CVE-2025-71463.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-71463",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T23:12:43.913Z",
"datePublished": "2026-11-13T09:36:59.897Z",
"dateUpdated": "2026-11-13T09:36:59.897Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:59.897Z"
},
"datePublic": "2025-10-22T00:00:00.000Z",
"title": "Scapy before 2.7.0 Insecure Deserialization RCE via Session Files",
"descriptions": [
{
"lang": "en",
"value": "Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__()."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Deserialization of Untrusted Data",
"cweId": "CWE-502",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "secdev",
"product": "scapy",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/scapy",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.7.0"
},
{
"version": "2.7.0",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:scapy:scapy:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-cq46-m9x9-j8w2)"
},
{
"name": "VulnCheck Advisory: Scapy before 2.7.0 Insecure Deserialization RCE via Session Files",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files"
}
],
"credits": [
{
"lang": "en",
"value": "anotherik",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/103xxx/CVE-2026-103645.json
+204
View File
@@ -0,0 +1,204 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-103645",
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"state": "PUBLISHED",
"assignerShortName": "Qt",
"dateReserved": "2026-10-01T06:20:58.674Z",
"datePublished": "2026-11-13T09:36:23.530Z",
"dateUpdated": "2026-11-13T09:36:23.530Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "Qt",
"dateUpdated": "2026-11-13T09:36:23.530Z"
},
"title": "Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt",
"datePublic": "2026-11-13T09:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92 Forced Integer Overflow"
}
]
}
],
"affected": [
{
"vendor": "qt",
"product": "qt",
"modules": [
"qtbase",
"qt5compat"
],
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.0.0",
"versionType": "python"
},
{
"status": "affected",
"version": "5.0.0",
"lessThan": "6.8.9",
"versionType": "python"
},
{
"status": "affected",
"version": "6.9.0",
"lessThan": "6.11.3",
"versionType": "python"
}
],
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*",
"cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*"
]
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0.0",
"versionEndExcluding": "6.8.9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.0",
"versionEndExcluding": "6.11.3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0.0",
"versionEndExcluding": "6.0.0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.8.9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.0",
"versionEndExcluding": "6.11.3"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>An integer overflow vulnerability in the Qt <code>QTextCodec</code> <code>fromUnicode()</code> and <code>toUnicode()</code> functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.</p>"
}
]
}
],
"references": [
{
"url": "https://www.qt.io/security-advisories?search=CVE-2026-103645",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://codereview.qt-project.org/c/qt/qt5compat/+/762795",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "CLEAR",
"version": "4.0",
"baseSeverity": "LOW",
"baseScore": 1.1,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:U/U:Clear"
}
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/106xxx/CVE-2026-106172.json
+10 -7
View File
@@ -8,7 +8,7 @@
"assignerShortName": "fortinet",
"dateReserved": "2026-10-06T16:19:44.280Z",
"datePublished": "2026-10-13T17:37:16.459Z",
"dateUpdated": "2026-11-06T15:42:03.991Z"
"dateUpdated": "2026-11-13T10:04:26.266Z"
},
"containers": {
"cna": {
@@ -64,9 +64,12 @@
"vendor": "Fortinet",
"product": "FortiSandbox Cloud",
"cpes": [
"cpe:2.3:a:fortinet:fortisandboxcloud:5.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:*:*:*:*:*:*:*",
@@ -85,14 +88,14 @@
"versions": [
{
"versionType": "semver",
"version": "5.0.4",
"lessThanOrEqual": "5.0.6",
"version": "5.2.0",
"lessThanOrEqual": "5.2.1",
"status": "affected"
},
{
"versionType": "semver",
"version": "5.0.0",
"lessThanOrEqual": "5.0.2",
"lessThanOrEqual": "5.0.6",
"status": "affected"
},
{
@@ -107,13 +110,13 @@
"descriptions": [
{
"lang": "en",
"value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.0.4 through 5.0.6, FortiSandbox Cloud 5.0.0 through 5.0.2, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests"
"value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests"
}
],
"providerMetadata": {
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet",
"dateUpdated": "2026-11-06T15:42:03.991Z"
"dateUpdated": "2026-11-13T10:04:26.266Z"
},
"problemTypes": [
{
@@ -149,7 +152,7 @@
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiSandbox version 5.2.2 or above\nUpgrade to FortiSandbox version 5.0.7 or above\nUpgrade to FortiSandbox Cloud version 5.2.2 or above"
"value": "Upgrade to FortiSandbox version 5.2.2 or above\nUpgrade to FortiSandbox version 5.0.7 or above\nUpgrade to FortiSandbox Cloud version 5.2.2 or above\nUpgrade to FortiSandbox Cloud version 5.0.7 or above"
}
],
"references": [
data/2026/112xxx/CVE-2026-112181.json
+157
View File
@@ -0,0 +1,157 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-112181",
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"state": "PUBLISHED",
"assignerShortName": "INCIBE",
"dateReserved": "2026-10-19T09:03:18.525Z",
"datePublished": "2026-11-13T09:54:21.059Z",
"dateUpdated": "2026-11-13T10:13:21.512Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE",
"dateUpdated": "2026-11-13T10:13:21.512Z"
},
"title": "Multiple Vulnerabilities in OpenKM Community Edition",
"datePublic": "2026-11-13T09:36:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-611",
"description": "CWE-611 Improper restriction of XML external entity reference",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "OpenKM",
"product": "OpenKM Community Edition",
"versions": [
{
"status": "affected",
"version": "6.3.3",
"lessThanOrEqual": "6.3.13",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.3"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openkm:openkm_community_edition:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.3",
"versionEndIncluding": "6.3.13"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openkm:openkm_community_edition:7.0.3:*:*:*:*:*:*:*"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server."
}
]
}
],
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Update OpenKM CE 7.0.3 to 7.0.4, which has already been released. According to the manufacturer, the entity resolver has been fixed, and general and parameter external entities have been disabled by enabling FEATURE_SECURE_PROCESSING. For versions 6.3.3 through 6.3.13, the fix will be included in 6.3.14, which is pending release; HTTP requests for non-local DTDs have also been removed.\n\n\nAs a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.\n\n\n\nThe manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>Update OpenKM CE 7.0.3 to 7.0.4, which has already been released. According to the manufacturer, the entity resolver has been fixed, and general and parameter external entities have been disabled by enabling FEATURE_SECURE_PROCESSING. For versions 6.3.3 through 6.3.13, the fix will be included in 6.3.14, which is pending release; HTTP requests for non-local DTDs have also been removed.</span><div><span><br></span></div><div><span>As a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.</span></div><div><div><p>The manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.</p></div></div>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Carlos Alejandro Smith Tay (Las3rs)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/112xxx/CVE-2026-112182.json
+153
View File
@@ -0,0 +1,153 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-112182",
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"state": "PUBLISHED",
"assignerShortName": "INCIBE",
"dateReserved": "2026-10-19T09:03:19.676Z",
"datePublished": "2026-11-13T10:11:27.327Z",
"dateUpdated": "2026-11-13T10:11:27.327Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE",
"dateUpdated": "2026-11-13T10:11:27.327Z"
},
"title": "Multiple Vulnerabilities in OpenKM Community Edition",
"datePublic": "2026-11-13T09:57:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "OpenKM",
"product": "OpenKM Community Edition",
"versions": [
{
"status": "affected",
"version": "6.3.12"
},
{
"status": "affected",
"version": "6.3.13"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openkm:openkm_community_edition:6.3.12:*:*:*:*:*:*:*"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openkm:openkm_community_edition:6.3.13:*:*:*:*:*:*:*"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root."
}
]
}
],
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Update to OpenKM CE 6.3.14 when it becomes available. The vendor states that creating and deleting process definitions will require the administrator role at the business layer, covering REST, SOAP, and the administration interface.\n\n\nAs a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.\n\n\n\nThe manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>Update to OpenKM CE 6.3.14 when it becomes available. The vendor states that creating and deleting process definitions will require the administrator role at the business layer, covering REST, SOAP, and the administration interface.</span><div><br><div><p>As a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.</p><p>The manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.</p></div></div>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Carlos Alejandro Smith Tay (Las3rs)",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/115xxx/CVE-2026-115871.json
+106
View File
@@ -0,0 +1,106 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-115871",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-23T18:33:00.912Z",
"datePublished": "2026-11-13T09:35:10.951Z",
"dateUpdated": "2026-11-13T09:35:10.951Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:10.951Z"
},
"affected": [
{
"vendor": "renehermi",
"product": "WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "4.19.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."
}
],
"title": "WP STAGING <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-73 External Control of File Name or Path",
"cweId": "CWE-73",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 2.7,
"baseSeverity": "LOW"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-12T21:00:20.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/116xxx/CVE-2026-116418.json
+102
View File
@@ -0,0 +1,102 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116418",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T09:20:16.351Z",
"dateUpdated": "2026-11-13T09:20:16.351Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T09:20:16.351Z"
},
"datePublic": "2026-11-03T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerScale InsightIQ",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "6.4.1 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/116xxx/CVE-2026-116433.json
+102
View File
@@ -0,0 +1,102 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116433",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T09:16:36.792Z",
"dateUpdated": "2026-11-13T09:16:36.792Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T09:16:36.792Z"
},
"datePublic": "2026-11-03T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerScale InsightIQ",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "6.4.1 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/116xxx/CVE-2026-116509.json
+103
View File
@@ -0,0 +1,103 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116509",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-26T13:13:50.719Z",
"datePublished": "2026-11-13T09:35:15.539Z",
"dateUpdated": "2026-11-13T09:35:15.539Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:15.539Z"
},
"affected": [
{
"vendor": "expresstech",
"product": "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "11.2.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call."
}
],
"title": "Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/classes/class-qmn-quiz-manager.php#L688"
},
{
"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1187"
},
{
"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1193"
},
{
"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1209"
},
{
"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/functions.php#L1135"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3779826%40quiz-master-next&new=3779826%40quiz-master-next"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-12T20:51:37.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/116xxx/CVE-2026-116614.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116614",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-26T16:56:43.367Z",
"datePublished": "2026-11-13T09:35:13.682Z",
"dateUpdated": "2026-11-13T09:35:13.682Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:13.682Z"
},
"affected": [
{
"vendor": "aukejomm",
"product": "WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "2.24.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to generic SQL Injection via the 'sourceId' parameter in all versions up to, and including, 2.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The plugin grants the edit_feeds capability to the Editor role on activation, meaning any Editor-level user satisfies the authorization checks and can exploit this vulnerability."
}
],
"title": "WPMR Google Feed Manager for WooCommerce <= 2.24.1 - Authenticated (Editor+) SQL Injection via 'sourceId' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7cecb044-2dba-494f-b85c-41bafa69e330?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php#L42"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-ajax-data.php#L59"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php#L64"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3792176"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.2/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 4.9,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-10-26T17:14:10.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:59:39.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/116xxx/CVE-2026-116615.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116615",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-26T16:58:35.221Z",
"datePublished": "2026-11-13T09:35:12.566Z",
"dateUpdated": "2026-11-13T09:35:12.566Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:12.566Z"
},
"affected": [
{
"vendor": "marketingfire",
"product": "Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "4.2.6.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!--start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping — persisting the payload verbatim to the database — while the render-side `str_replace` reconstitutes the key to `class`, feeding the attacker-controlled `logic` value directly into `@eval`. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary `get_option`, `get_user_meta`, and `get_post_meta` values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the `widgetopts_allowed_php_functions` filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes `widgetopts_safe_eval_trusted()` to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above."
}
],
"title": "Widget Options <= 4.2.6.1 - Authenticated (Contributor+) Code Injection via 'post_content' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5e4431-2789-47c8-81ce-e9f67454accc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L496"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L331"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L377"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/extras.php#L792"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.7/includes/widgets/gutenberg/gutenberg-toolbar.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-94 Improper Control of Generation of Code",
"cweId": "CWE-94",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-10-26T17:15:25.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:59:16.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/118xxx/CVE-2026-118191.json
+108
View File
@@ -0,0 +1,108 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118191",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-27T18:53:29.970Z",
"datePublished": "2026-11-13T09:35:15.166Z",
"dateUpdated": "2026-11-13T09:35:15.166Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:15.166Z"
},
"affected": [
{
"vendor": "smub",
"product": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "4.5.5",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can be delegated to lower-privileged roles via the plugin's Roles screen."
}
],
"title": "Photo Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e01402-f866-43b9-9fef-7e9b156a9e0d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2943"
},
{
"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2764"
},
{
"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L164"
},
{
"url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2395"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3793263/nextgen-gallery/trunk/src/Lightroom/Controller.php?old=3773860&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FLightroom%2FController.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3793263/nextgen-gallery/trunk/src/Lightroom/Controller.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-10-27T19:08:59.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:54:54.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/118xxx/CVE-2026-118587.json
+102
View File
@@ -0,0 +1,102 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-118587",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-28T16:15:20.499Z",
"datePublished": "2026-11-13T09:35:18.085Z",
"dateUpdated": "2026-11-13T09:35:18.085Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:18.085Z"
},
"affected": [
{
"vendor": "blubrry",
"product": "PowerPress Podcasting plugin by Blubrry",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "11.18.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayer_build_html5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own."
}
],
"title": "PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d3930f-d2da-4992-ad3a-228ffd7a5a6c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L1240"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L135"
},
{
"url": "https://plugins.trac.wordpress.org/browser/powerpress?rev=3782100#trunk"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3782099/powerpress/trunk/powerpress-player.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-10-28T16:30:48.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:54:59.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/119xxx/CVE-2026-119077.json
+114
View File
@@ -0,0 +1,114 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-119077",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-29T13:09:51.023Z",
"datePublished": "2026-11-13T09:35:17.360Z",
"dateUpdated": "2026-11-13T09:35:17.360Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:17.360Z"
},
"affected": [
{
"vendor": "elextensions",
"product": "ELEX WordPress HelpDesk & Customer Ticketing System",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.3.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack."
}
],
"title": "ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f14b07ce-8893-4f8c-a501-5da6ec5a3b8f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L822"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L156"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L265"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L627"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions.php#L946"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php#L45"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L529"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3797458/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-public-functions.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-502 Deserialization of Untrusted Data",
"cweId": "CWE-502",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Osman Hussein"
}
],
"timeline": [
{
"time": "2026-10-29T13:22:59.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:10:29.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/120xxx/CVE-2026-120547.json
+108
View File
@@ -0,0 +1,108 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120547",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-02T16:24:41.752Z",
"datePublished": "2026-11-13T09:35:11.842Z",
"dateUpdated": "2026-11-13T09:35:11.842Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:11.842Z"
},
"affected": [
{
"vendor": "saadiqbal",
"product": "CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.8.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability."
}
],
"title": "CF7 Apps <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3091d345-2532-433c-83e0-2e253a4cd8d4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L415"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L440"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L392"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L488"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L341"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3772728%40contact-form-7-honeypot&new=3772728%40contact-form-7-honeypot"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 4.4,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-10-01T03:38:34.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:50:08.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/120xxx/CVE-2026-120573.json
+102
View File
@@ -0,0 +1,102 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120573",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-02T16:39:41.029Z",
"datePublished": "2026-11-13T09:35:15.899Z",
"dateUpdated": "2026-11-13T09:35:15.899Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:15.899Z"
},
"affected": [
{
"vendor": "etruel",
"product": "WPeMatico RSS Feed Fetcher",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "2.9.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaign_data, bypassing wp_kses sanitization, and executes in the browser session of any user with edit_posts — including Administrators — who opens the WPeMatico campaigns list screen."
}
],
"title": "WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d93d4360-b66c-499a-838c-e8eea36bd364?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaigns_list.php#L820"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/wpematico_functions.php#L1106"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaign_edit.php#L540"
},
{
"url": "https://github.com/etruel/wpematico/tree/2.9.2"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-10-30T16:24:41.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:59:31.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/120xxx/CVE-2026-120658.json
+102
View File
@@ -0,0 +1,102 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120658",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-02T18:43:02.986Z",
"datePublished": "2026-11-13T09:35:14.804Z",
"dateUpdated": "2026-11-13T09:35:14.804Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:14.804Z"
},
"affected": [
{
"vendor": "codename065",
"product": "Download Manager",
"versions": [
{
"version": "6.0.0",
"status": "affected",
"lessThanOrEqual": "7.6.3",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_previews][]' parameter in all versions up to, and including, 7.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpdm_sanitize_array() function strips HTML tags via wp_kses but leaves bare single quotes intact and calls stripslashes_deep() which defeats WordPress magic quotes protection, allowing a single-quote-based attribute breakout payload to be stored verbatim and later rendered without escaping."
}
],
"title": "Download Manager <= 7.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4085834-3865-4b9e-9497-f14e6e32554b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/PackageController.php#L2296"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L169"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L113"
},
{
"url": "https://www.wpdownloadmanager.com/changelogs/"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-02T18:58:14.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:48:27.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/120xxx/CVE-2026-120688.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120688",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-02T19:24:28.770Z",
"datePublished": "2026-11-13T09:35:12.209Z",
"dateUpdated": "2026-11-13T09:35:12.209Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:12.209Z"
},
"affected": [
{
"vendor": "scheeeli",
"product": "EZ SQL Reports Shortcode Widget and DB Backup",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "5.25.25",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation."
}
],
"title": "EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.25 - Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/376eec5d-a629-4765-8ace-09e21bf3c2e8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L385"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L419"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L517"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elisqlreports/trunk"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3791213/elisqlreports/trunk/index.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adrien Brunner"
}
],
"timeline": [
{
"time": "2026-11-02T19:40:25.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:11:24.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/121xxx/CVE-2026-121518.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-121518",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-03T14:25:35.591Z",
"datePublished": "2026-11-13T09:35:16.266Z",
"dateUpdated": "2026-11-13T09:35:16.266Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:16.266Z"
},
"affected": [
{
"vendor": "ivole",
"product": "Customer Reviews for WooCommerce",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "5.127.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring."
}
],
"title": "Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L26"
},
{
"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L584"
},
{
"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L407"
},
{
"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L24"
},
{
"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L284"
},
{
"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L159"
},
{
"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L175"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3791702/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3791702/customer-reviews-woocommerce/trunk/includes/blocks/class-cr-all-reviews.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Shon Bida"
}
],
"timeline": [
{
"time": "2026-11-03T14:42:23.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:10:05.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/122xxx/CVE-2026-122063.json
+114
View File
@@ -0,0 +1,114 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-122063",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-04T16:46:09.007Z",
"datePublished": "2026-11-13T09:35:12.949Z",
"dateUpdated": "2026-11-13T09:35:12.949Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:12.949Z"
},
"affected": [
{
"vendor": "contrid",
"product": "Newsletters",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "4.18.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the admin-controlled 'currentusersubscribed' option to be enabled and at least one page rendering the Newsletters subscribe shortcode or widget to exist; a Subscriber-level attacker can self-serve the attack by updating their own profile email to a crafted payload and loading such a page."
}
],
"title": "Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/68348c03-d0ba-4dcc-8b18-a4675d6dce27?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default/subscribe.php#L552"
},
{
"url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default/widget.php#L12"
},
{
"url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default2/subscribe.php#L571"
},
{
"url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default2/widget.php#L12"
},
{
"url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/helpers/shortcode.php#L1416"
},
{
"url": "https://wordpress.org/plugins/newsletters-lite/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3794975/newsletters-lite/trunk/views/default/subscribe.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3794975%40newsletters-lite&new=3794975%40newsletters-lite"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-04T17:02:50.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:04:45.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/122xxx/CVE-2026-122227.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-122227",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-04T20:43:42.608Z",
"datePublished": "2026-11-13T09:35:16.630Z",
"dateUpdated": "2026-11-13T09:35:16.630Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:16.630Z"
},
"affected": [
{
"vendor": "mervb1",
"product": "Easy Property Listings",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.5.28",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field() function is applied to the attribute value but does not escape single quotes, providing no mitigation against breaking out of the SQL IN('...') literal."
}
],
"title": "Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0389e2-ab65-4652-a3e9-521dfd2e54a8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L1851"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/widgets/widget-functions.php#L390"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/templates/content/shortcodes/listing-search/default.php#L119"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/shortcodes/shortcode-listing-search.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L1859"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L2349"
},
{
"url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.29"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-04T20:59:25.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:02:46.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/123xxx/CVE-2026-123769.json
+108
View File
@@ -0,0 +1,108 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123769",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-06T13:59:04.747Z",
"datePublished": "2026-11-13T09:35:11.454Z",
"dateUpdated": "2026-11-13T09:35:11.454Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:11.454Z"
},
"affected": [
{
"vendor": "brainstormforce",
"product": "SureDash – Community, Courses & Member Dashboard",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.13.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role."
}
],
"title": "SureDash <= 1.13.0 - Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f317dcd-dc4f-482a-8faa-91cd9c022276?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/sanitizer.php#L101"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/settings.php#L604"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/services/router.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/backend.php#L1309"
},
{
"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/social-logins.php#L472"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3794229/suredash/trunk/core/routers/backend.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-269 Improper Privilege Management",
"cweId": "CWE-269",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-06T14:15:26.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:55:05.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/124xxx/CVE-2026-124218.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124218",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-06T22:32:02.354Z",
"datePublished": "2026-11-13T09:35:16.995Z",
"dateUpdated": "2026-11-13T09:35:16.995Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:16.995Z"
},
"affected": [
{
"vendor": "addonsorg",
"product": "Drag and Drop File Upload for Elementor Forms",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.6.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the \"yeepdf_not_save\" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path."
}
],
"title": "Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee73bfb0-843c-4b4a-b513-3980c1cefac1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L838"
},
{
"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L764"
},
{
"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L724"
},
{
"url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L849"
},
{
"url": "https://downloads.wordpress.org/plugin/drag-and-drop-file-upload-for-elementor-forms.1.6.3.zip"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"baseScore": 8.2,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "nh4tvd"
}
],
"timeline": [
{
"time": "2026-11-06T22:47:18.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:09:58.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125055.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125055",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-09T16:27:26.174Z",
"datePublished": "2026-11-13T09:35:13.330Z",
"dateUpdated": "2026-11-13T09:35:13.330Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:13.330Z"
},
"affected": [
{
"vendor": "sameh101",
"product": "Chatterbug Forms – Fast, Flexible WordPress Form Builder",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.0.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier."
}
],
"title": "Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L422"
},
{
"url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L331"
},
{
"url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L510"
},
{
"url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L308"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3794492/chatterbug-forms/trunk/chatterbug-forms.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"cweId": "CWE-434",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "samathakeeling"
}
],
"timeline": [
{
"time": "2026-11-10T08:32:15.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:10:49.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125409.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125409",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-09T22:24:31.767Z",
"datePublished": "2026-11-13T09:35:14.057Z",
"dateUpdated": "2026-11-13T09:35:14.057Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:14.057Z"
},
"affected": [
{
"vendor": "wpchill",
"product": "Passster – Password Protect Pages and Content",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "4.3.21",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passster_id or passster_headline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by do_shortcode() — bypassing the per-attribute escaping present inside render_shortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filter_the_content() has no edit-permission capability gate."
}
],
"title": "Passster <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81cf06d2-9b5a-4f9f-adf9-890b46db7783?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L417"
},
{
"url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L429"
},
{
"url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L294"
},
{
"url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/admin/inc/class-ps-meta.php#L82"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3793918/content-protector/trunk/inc/class-ps-public.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-09T22:39:46.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:48:11.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/125xxx/CVE-2026-125948.json
+108
View File
@@ -0,0 +1,108 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125948",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-10T14:27:30.419Z",
"datePublished": "2026-11-13T09:35:14.454Z",
"dateUpdated": "2026-11-13T09:35:14.454Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:14.454Z"
},
"affected": [
{
"vendor": "wpzoom",
"product": "Recipe Card Blocks Lite",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.7.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post() preserves block-delimiter HTML comments verbatim on save, a Contributor can embed event-handler payloads inside the block's steps[].text attribute in a draft or pending post without the unfiltered_html capability, and the payload executes for any visitor — including privileged editors and administrators who preview or publish the post — as well as through the public print endpoint."
}
],
"title": "Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed1f200-d4ae-4c9e-a618-fbeb58c0f3f3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L184"
},
{
"url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L1999"
},
{
"url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L63"
},
{
"url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L90"
},
{
"url": "https://wordpress.org/plugins/recipe-card-blocks-by-wpzoom/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3794649/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-steps.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-10T14:43:44.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T20:54:40.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/126xxx/CVE-2026-126029.json
+108
View File
@@ -0,0 +1,108 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126029",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2026-11-10T16:10:43.832Z",
"datePublished": "2026-11-13T09:35:17.735Z",
"dateUpdated": "2026-11-13T09:35:17.735Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-13T09:35:17.735Z"
},
"affected": [
{
"vendor": "wpzoom",
"product": "WPZOOM Addons for Elementor – Starter Templates & Widgets",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.4.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"title": "WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f25b6009-0edb-4acd-97a3-c24e6e51fecc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L1103"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L891"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L1057"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/frontend.js#L72"
},
{
"url": "https://wordpress.org/plugins/wpzoom-elementor-addons/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3795911/wpzoom-elementor-addons/trunk/includes/widgets/world-map/world-map.php"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"timeline": [
{
"time": "2026-11-10T16:25:59.000Z",
"lang": "en",
"value": "Vendor Notified"
},
{
"time": "2026-11-12T21:00:10.000Z",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
data/2026/126xxx/CVE-2026-126264.json
+152
View File
@@ -0,0 +1,152 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126264",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.556Z",
"datePublished": "2026-11-13T09:36:51.089Z",
"dateUpdated": "2026-11-13T09:36:51.089Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:51.089Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile",
"descriptions": [
{
"lang": "en",
"value": "SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "siyuan-note",
"product": "siyuan",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/siyuan",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.8.9"
},
{
"version": "3.8.9",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.8.9"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.3,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3pm7-cc76-7j2p",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-3pm7-cc76-7j2p)"
},
{
"url": "https://github.com/siyuan-note/siyuan/commit/d122dee55e8d3c77de313d0ad6efae8b6b0ebc07",
"tags": [
"patch"
],
"name": "Patch Commit"
},
{
"name": "VulnCheck Advisory: SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.9-sensitive-file-disclosure-via-api-file-getfile"
}
],
"credits": [
{
"lang": "en",
"value": "rexpository",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126265.json
+146
View File
@@ -0,0 +1,146 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126265",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.556Z",
"datePublished": "2026-11-13T09:36:50.432Z",
"dateUpdated": "2026-11-13T09:36:50.432Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:50.432Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie",
"descriptions": [
{
"lang": "en",
"value": "SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Restriction of Excessive Authentication Attempts",
"cweId": "CWE-307",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "siyuan-note",
"product": "siyuan",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
"versions": [
{
"version": "2.1.0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.8.9"
},
{
"version": "3.8.9",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.1.0",
"versionEndExcluding": "3.8.9"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-23g4-vqq8-5764",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-23g4-vqq8-5764)"
},
{
"name": "VulnCheck Advisory: SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.9-captcha-bypass-via-stale-login-cookie"
}
],
"credits": [
{
"lang": "en",
"value": "rexpository",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126266.json
+146
View File
@@ -0,0 +1,146 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126266",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.556Z",
"datePublished": "2026-11-13T09:36:49.770Z",
"dateUpdated": "2026-11-13T09:36:49.770Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:49.770Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords",
"descriptions": [
{
"lang": "en",
"value": "SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "siyuan-note",
"product": "siyuan",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/SiYuan",
"versions": [
{
"version": "3.6.0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.8.9"
},
{
"version": "3.8.9",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.6.0",
"versionEndExcluding": "3.8.9"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qf37-w288-frvq",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-qf37-w288-frvq)"
},
{
"name": "VulnCheck Advisory: SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/siyuan-from-3.6.0-before-3.8.9-publish-password-bypass-via-getdoc-regex-keywords"
}
],
"credits": [
{
"lang": "en",
"value": "rexpository",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126267.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126267",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:49.116Z",
"dateUpdated": "2026-11-13T09:36:49.116Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:49.116Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging",
"descriptions": [
{
"lang": "en",
"value": "NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Input Validation",
"cweId": "CWE-20",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.300.0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.04.4"
},
{
"version": "2026.04.4",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.300.0",
"versionEndExcluding": "2026.04.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-gcxw-8q43-jhjc",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-gcxw-8q43-jhjc)"
},
{
"name": "VulnCheck Advisory: NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-from-0.300.0-before-2026.04.4-denial-of-service-via-metaservice-logging"
}
],
"credits": [
{
"lang": "en",
"value": "5255fgh",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126268.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126268",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:48.470Z",
"dateUpdated": "2026-11-13T09:36:48.470Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:48.470Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Origin Validation Error",
"cweId": "CWE-346",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-2rm5-wf7w-8j57",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-2rm5-wf7w-8j57)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-ip-address-spoofing-via-unconditional-proxy-trust"
}
],
"credits": [
{
"lang": "en",
"value": "5255fgh",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126269.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126269",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:47.840Z",
"dateUpdated": "2026-11-13T09:36:47.840Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:47.840Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.09.0"
},
{
"version": "2026.09.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.09.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3f7w-wqf7-786q",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-3f7w-wqf7-786q)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-stored-xss-via-attachment-mime-type"
}
],
"credits": [
{
"lang": "en",
"value": "PratibhaDevi29",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126270.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126270",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:47.205Z",
"dateUpdated": "2026-11-13T09:36:47.205Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:47.205Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authentication for Critical Function",
"cweId": "CWE-306",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.09.1"
},
{
"version": "2026.09.1",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.09.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-5892-3964-gc52",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-5892-3964-gc52)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.1-unauthenticated-information-disclosure-via-aggregated-meta-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "ya3raj",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126271.json
+137
View File
@@ -0,0 +1,137 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126271",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:46.548Z",
"dateUpdated": "2026-11-13T09:36:46.548Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:46.548Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Insufficiently Protected Credentials",
"cweId": "CWE-522",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.09.0"
},
{
"version": "2026.09.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.09.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.3,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-rjc4-j36j-gjjc",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-rjc4-j36j-gjjc)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-tls-private-key-exposure-via-data-source-read"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126272.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126272",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:45.727Z",
"dateUpdated": "2026-11-13T09:36:45.727Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:45.727Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Allocation of Resources Without Limits or Throttling",
"cweId": "CWE-770",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.09.0"
},
{
"version": "2026.09.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.09.0"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-mmvm-m83w-6684",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-mmvm-m83w-6684)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-uncontrolled-resource-consumption-via-bulk-record-endpoints"
}
],
"credits": [
{
"lang": "en",
"value": "iaohkut-from-NightWolf-Team",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126273.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126273",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:45.077Z",
"dateUpdated": "2026-11-13T09:36:45.077Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:45.077Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Privilege Management",
"cweId": "CWE-269",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.09.0"
},
{
"version": "2026.09.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.09.0"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-mjxv-r6j7-m8gv",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-mjxv-r6j7-m8gv)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-privilege-escalation-via-incomplete-admin-bootstrap"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126274.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126274",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.971Z",
"datePublished": "2026-11-13T09:36:44.396Z",
"dateUpdated": "2026-11-13T09:36:44.396Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:44.396Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-638g-xw92-xq9x)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog"
}
],
"credits": [
{
"lang": "en",
"value": "cy3erm",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126275.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126275",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:43.720Z",
"dateUpdated": "2026-11-13T09:36:43.720Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:43.720Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.09.0 IDOR in Row Comment Operations",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.09.0"
},
{
"version": "2026.09.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.09.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x3xv-qpw2-33x6",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-x3xv-qpw2-33x6)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.09.0 IDOR in Row Comment Operations",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-idor-in-row-comment-operations"
}
],
"credits": [
{
"lang": "en",
"value": "bwbugs",
"type": "reporter"
},
{
"lang": "en",
"value": "Fla4sh",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126276.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126276",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:43.031Z",
"dateUpdated": "2026-11-13T09:36:43.031Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:43.031Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Authentication",
"cweId": "CWE-287",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.1"
},
{
"version": "2026.08.1",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-4cx5-q9xx-5pgj",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-4cx5-q9xx-5pgj)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-client-authentication-bypass-via-oauth-token-exchange"
}
],
"credits": [
{
"lang": "en",
"value": "mantraak",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126277.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126277",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:42.352Z",
"dateUpdated": "2026-11-13T09:36:42.352Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:42.352Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Allocation of Resources Without Limits or Throttling",
"cweId": "CWE-770",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.1"
},
{
"version": "2026.08.1",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-2j2m-jqcx-2q2j",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-2j2m-jqcx-2q2j)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-uncontrolled-resource-consumption-via-shared-view-bulk-api"
}
],
"credits": [
{
"lang": "en",
"value": "pavanchow",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126278.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126278",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:41.678Z",
"dateUpdated": "2026-11-13T09:36:41.678Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:41.678Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.1 Password Reset Token Race Condition",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
"cweId": "CWE-362",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.1"
},
{
"version": "2026.08.1",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.1"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-7mf9-q77p-r4r3",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-7mf9-q77p-r4r3)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.1 Password Reset Token Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-password-reset-token-race-condition"
}
],
"credits": [
{
"lang": "en",
"value": "NinjaGPT",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126279.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126279",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:40.988Z",
"dateUpdated": "2026-11-13T09:36:40.988Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:40.988Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.06.2"
},
{
"version": "2026.06.2",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-j96w-qm45-vgp2",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-j96w-qm45-vgp2)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-stored-xss-via-ai-field-prompt-tooltip"
}
],
"credits": [
{
"lang": "en",
"value": "geo-chen",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126280.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126280",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:39.321Z",
"dateUpdated": "2026-11-13T09:36:39.321Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:39.321Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
"cweId": "CWE-362",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-mh65-9xcf-vf8v",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-mh65-9xcf-vf8v)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-refresh-token-reuse-via-non-atomic-rotation"
}
],
"credits": [
{
"lang": "en",
"value": "komyunghan",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126281.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126281",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:38.488Z",
"dateUpdated": "2026-11-13T09:36:38.488Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:38.488Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-355h-p2mj-vwc9",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-355h-p2mj-vwc9)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-private-integration-credential-exposure-via-copy"
}
],
"credits": [
{
"lang": "en",
"value": "komyunghan",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126282.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126282",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:37.841Z",
"dateUpdated": "2026-11-13T09:36:37.841Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:37.841Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update",
"descriptions": [
{
"lang": "en",
"value": "NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Privilege Management",
"cweId": "CWE-269",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2026.04.0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2026.04.0",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-jj94-6wwc-qhcx)"
},
{
"name": "VulnCheck Advisory: NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update"
}
],
"credits": [
{
"lang": "en",
"value": "komyunghan",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126283.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126283",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:37.190Z",
"dateUpdated": "2026-11-13T09:36:37.190Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:37.190Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-7395-6gh4-5q8p",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-7395-6gh4-5q8p)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-incorrect-authorization-via-base-scoped-api-tokens"
}
],
"credits": [
{
"lang": "en",
"value": "komyunghan",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126284.json
+138
View File
@@ -0,0 +1,138 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126284",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.178Z",
"datePublished": "2026-11-13T09:36:36.525Z",
"dateUpdated": "2026-11-13T09:36:36.525Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:36.525Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch",
"descriptions": [
{
"lang": "en",
"value": "NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Server-Side Request Forgery (SSRF)",
"cweId": "CWE-918",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2026.05.2",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.07.0"
},
{
"version": "2026.07.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2026.05.2",
"versionEndExcluding": "2026.07.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-6q3f-6mpq-cqgc",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-6q3f-6mpq-cqgc)"
},
{
"name": "VulnCheck Advisory: NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-2026.05.2-before-2026.07.0-ssrf-via-data-import-url-fetch"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126285.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126285",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.178Z",
"datePublished": "2026-11-13T09:36:35.854Z",
"dateUpdated": "2026-11-13T09:36:35.854Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:35.854Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.3,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-f2jp-xg6f-hjf6",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-f2jp-xg6f-hjf6)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-sql-injection-via-legacy-where-query-filter"
}
],
"credits": [
{
"lang": "en",
"value": "tikket1",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126286.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126286",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.178Z",
"datePublished": "2026-11-13T09:36:35.200Z",
"dateUpdated": "2026-11-13T09:36:35.200Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:35.200Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.08.0"
},
{
"version": "2026.08.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.08.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x3wx-294c-4p48",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-x3wx-294c-4p48)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-reflected-xss-via-ncredirecturl-in-pageleavingwarning-vue"
}
],
"credits": [
{
"lang": "en",
"value": "dhairya7760",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126287.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126287",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.178Z",
"datePublished": "2026-11-13T09:36:34.544Z",
"dateUpdated": "2026-11-13T09:36:34.544Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:34.544Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
"cweId": "CWE-362",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.06.2"
},
{
"version": "2026.06.2",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-353r-pj87-54hc",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-353r-pj87-54hc)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-oauth-refresh-token-rotation-race-condition"
}
],
"credits": [
{
"lang": "en",
"value": "bytejmp",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126288.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126288",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:33.855Z",
"dateUpdated": "2026-11-13T09:36:33.855Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:33.855Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.06.2"
},
{
"version": "2026.06.2",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-rmx6-f46x-5hhx",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-rmx6-f46x-5hhx)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-credential-disclosure-via-public-oauth-client-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "bytejmp",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126289.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126289",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:33.112Z",
"dateUpdated": "2026-11-13T09:36:33.112Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:33.112Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"cweId": "CWE-1236",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.06.1"
},
{
"version": "2026.06.1",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8wgf-24mr-w88q",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-8wgf-24mr-w88q)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-csv-formula-injection-via-export-service-ts"
}
],
"credits": [
{
"lang": "en",
"value": "hunntr",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126290.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126290",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:32.519Z",
"dateUpdated": "2026-11-13T09:36:32.519Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:32.519Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.07.0"
},
{
"version": "2026.07.0",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.07.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-wxxj-mghf-33v4",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-wxxj-mghf-33v4)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.07.0-private-integration-credential-exposure-via-base-integration-read"
}
],
"credits": [
{
"lang": "en",
"value": "watermelon1221",
"type": "reporter"
},
{
"lang": "en",
"value": "meifukun",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126291.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126291",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:31.871Z",
"dateUpdated": "2026-11-13T09:36:31.871Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:31.871Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.06.2"
},
{
"version": "2026.06.2",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8qgc-rxmx-p7cw",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-8qgc-rxmx-p7cw)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-sql-injection-via-user-email-in-base-user-query"
}
],
"credits": [
{
"lang": "en",
"value": "PhilipPhil",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126292.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126292",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:31.185Z",
"dateUpdated": "2026-11-13T09:36:31.185Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:31.185Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"cweId": "CWE-200",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.06.1"
},
{
"version": "2026.06.1",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-q5wf-7cr7-72h3",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-q5wf-7cr7-72h3)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-password-hash-exposure-via-profile-update-response"
}
],
"credits": [
{
"lang": "en",
"value": "geo-chen",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126293.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126293",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:30.505Z",
"dateUpdated": "2026-11-13T09:36:30.505Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:30.505Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Allocation of Resources Without Limits or Throttling",
"cweId": "CWE-770",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nocodb",
"product": "nocodb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "2026.06.2"
},
{
"version": "2026.06.2",
"status": "unaffected",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-cxj6-g54p-jwxp",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-cxj6-g54p-jwxp)"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-attachment-size-limit-bypass-via-upload-by-url"
}
],
"credits": [
{
"lang": "en",
"value": "DavidCarliez",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126294.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126294",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:29.863Z",
"dateUpdated": "2026-11-13T09:36:29.863Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:29.863Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login",
"descriptions": [
{
"lang": "en",
"value": "Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Authentication",
"cweId": "CWE-287",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "getgrav",
"product": "grav",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.11.0"
},
{
"version": "3.11.0",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.11.0"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9h-4683-5fcx",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-4x9h-4683-5fcx)"
},
{
"name": "VulnCheck Advisory: Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-login-plugin-before-3.11.0-two-factor-authentication-bypass-via-login"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126295.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126295",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:29.196Z",
"dateUpdated": "2026-11-13T09:36:29.196Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:29.196Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths",
"descriptions": [
{
"lang": "en",
"value": "NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "3.10.0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.0",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 6.8,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-fg9w-wfp5-j933)"
},
{
"name": "VulnCheck Advisory: NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-arbitrary-file-read-via-bllipparser-model-paths"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126296.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126296",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:28.517Z",
"dateUpdated": "2026-11-13T09:36:28.517Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:28.517Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params",
"descriptions": [
{
"lang": "en",
"value": "NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "External Control of File Name or Path",
"cweId": "CWE-73",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-59f9-gqg8-mqpj",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-59f9-gqg8-mqpj)"
},
{
"name": "VulnCheck Advisory: NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-path-traversal-via-save-maxent-params-and-load-maxent-params"
}
],
"credits": [
{
"lang": "en",
"value": "F0DH1L",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126297.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126297",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:27.884Z",
"dateUpdated": "2026-11-13T09:36:27.884Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:27.884Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances",
"descriptions": [
{
"lang": "en",
"value": "NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Uncontrolled Resource Consumption",
"cweId": "CWE-400",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-v8f3-6phw-6mh9",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-v8f3-6phw-6mh9)"
},
{
"name": "VulnCheck Advisory: NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-cpu-denial-of-service-via-conllcorpusreader-srl-instances"
}
],
"credits": [
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126298.json
+150
View File
@@ -0,0 +1,150 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126298",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:27.213Z",
"dateUpdated": "2026-11-13T09:36:27.213Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:27.213Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form",
"descriptions": [
{
"lang": "en",
"value": "NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Uncontrolled Resource Consumption",
"cweId": "CWE-400",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-r53h-rw34-8h97",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-r53h-rw34-8h97)"
},
{
"name": "VulnCheck Advisory: NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-cpu-denial-of-service-via-tree-chomsky-normal-form"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126299.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126299",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:26.544Z",
"dateUpdated": "2026-11-13T09:36:26.544Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:26.544Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring",
"descriptions": [
{
"lang": "en",
"value": "NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Uncontrolled Resource Consumption",
"cweId": "CWE-400",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-89p3-fcch-88ph",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-89p3-fcch-88ph)"
},
{
"name": "VulnCheck Advisory: NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-time-denial-of-service-via-ccg-lexicon-fromstring"
}
],
"credits": [
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126300.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126300",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:25.918Z",
"dateUpdated": "2026-11-13T09:36:25.918Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:25.918Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize",
"descriptions": [
{
"lang": "en",
"value": "NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Inefficient Algorithmic Complexity",
"cweId": "CWE-407",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "3.2.5",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.5",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-ffr9-mgrr-wcvr",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-ffr9-mgrr-wcvr)"
},
{
"name": "VulnCheck Advisory: NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-from-3.2.5-before-3.10.4-cpu-exhaustion-via-treebankwordtokenizer-span-tokenize"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126301.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126301",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:25.223Z",
"dateUpdated": "2026-11-13T09:36:25.223Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:25.223Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize",
"descriptions": [
{
"lang": "en",
"value": "NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Inefficient Algorithmic Complexity",
"cweId": "CWE-407",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "3.6",
"status": "affected",
"versionType": "custom",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.6",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-gpwc-27cw-rh9r",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-gpwc-27cw-rh9r)"
},
{
"name": "VulnCheck Advisory: NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-from-3.6-before-3.10.4-quadratic-cpu-exhaustion-via-legalitysyllabletokenizer-tokenize"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126302.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126302",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.613Z",
"datePublished": "2026-11-13T09:36:24.559Z",
"dateUpdated": "2026-11-13T09:36:24.559Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:24.559Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query",
"descriptions": [
{
"lang": "en",
"value": "NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Link Resolution Before File Access ('Link Following')",
"cweId": "CWE-59",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "3.9.4",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.9.4",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-xmfg-f9cm-w86q",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-xmfg-f9cm-w86q)"
},
{
"name": "VulnCheck Advisory: NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-3.9.4-before-3.10.4-symlink-sandbox-escape-via-chat80-sql-query"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126303.json
+150
View File
@@ -0,0 +1,150 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126303",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.613Z",
"datePublished": "2026-11-13T09:36:23.874Z",
"dateUpdated": "2026-11-13T09:36:23.874Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:23.874Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()",
"descriptions": [
{
"lang": "en",
"value": "NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Uncontrolled Resource Consumption",
"cweId": "CWE-400",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-8fx7-8jr8-84rv",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-8fx7-8jr8-84rv)"
},
{
"name": "VulnCheck Advisory: NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-denial-of-service-via-steppingrecursivedescentparser-parse"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126304.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126304",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:23.105Z",
"dateUpdated": "2026-11-13T09:36:23.105Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:23.105Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader",
"descriptions": [
{
"lang": "en",
"value": "NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Link Resolution Before File Access ('Link Following')",
"cweId": "CWE-59",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nltk",
"product": "nltk",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"versions": [
{
"version": "3.10.0",
"status": "affected",
"versionType": "semver",
"lessThan": "3.10.4"
},
{
"version": "3.10.4",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.0",
"versionEndExcluding": "3.10.4"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-qg35-44qx-7vrr",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-qg35-44qx-7vrr)"
},
{
"name": "VulnCheck Advisory: NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-symlink-escape-in-ycoecorpusreader"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126305.json
+178
View File
@@ -0,0 +1,178 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126305",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:22.424Z",
"dateUpdated": "2026-11-13T09:36:22.424Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:22.424Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments",
"descriptions": [
{
"lang": "en",
"value": "EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "espocrm",
"product": "espocrm",
"defaultStatus": "unaffected",
"versions": [
{
"version": "10.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "10.0.9"
},
{
"version": "10.0.9",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "espocrm",
"product": "espocrm",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "9.3.11"
},
{
"version": "9.3.11",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.9"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.3.11"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-j6q5-9jwj-9p8q",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-j6q5-9jwj-9p8q)"
},
{
"name": "VulnCheck Advisory: EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/espocrm-before-10.0.9-stored-xss-via-knowledge-base-article-attachments"
}
],
"credits": [
{
"lang": "en",
"value": "Paius-George",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126306.json
+178
View File
@@ -0,0 +1,178 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126306",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:21.753Z",
"dateUpdated": "2026-11-13T09:36:21.753Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:21.753Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment",
"descriptions": [
{
"lang": "en",
"value": "EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "espocrm",
"product": "espocrm",
"defaultStatus": "unaffected",
"versions": [
{
"version": "10.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "10.0.8"
},
{
"version": "10.0.8",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "espocrm",
"product": "espocrm",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "9.3.11"
},
{
"version": "9.3.11",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.8"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.3.11"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-4qv5-q4g7-hp5r",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-4qv5-q4g7-hp5r)"
},
{
"name": "VulnCheck Advisory: EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/espocrm-before-10.0.8-stored-xss-via-malicious-svg-attachment"
}
],
"credits": [
{
"lang": "en",
"value": "AdamKorcz",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126307.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126307",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:21.073Z",
"dateUpdated": "2026-11-13T09:36:21.073Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:21.073Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws",
"descriptions": [
{
"lang": "en",
"value": "Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nezhahq",
"product": "nezha",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/nezhahq/nezha",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.6.0"
},
{
"version": "2.6.0",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-63mg-cxm4-98q3",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-63mg-cxm4-98q3)"
},
{
"url": "https://github.com/nezhahq/nezha/commit/027bfcf6521f192635b946b7583c3ab39500ab98",
"tags": [
"patch"
],
"name": "Patch Commit"
},
{
"url": "https://github.com/nezhahq/nezha/commit/7cd0371b56f7bce83c3953b2bf4711b2105d5818",
"tags": [
"patch"
],
"name": "Patch Commit"
},
{
"name": "VulnCheck Advisory: Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nezha-dashboard-before-2.6.0-multiple-authorization-and-tenant-isolation-flaws"
}
],
"credits": [
{
"lang": "en",
"value": "chaconneX",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126308.json
+326
View File
@@ -0,0 +1,326 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126308",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:20.400Z",
"dateUpdated": "2026-11-13T09:36:20.400Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:20.400Z"
},
"datePublic": "2026-10-27T00:00:00.000Z",
"title": "Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
"descriptions": [
{
"lang": "en",
"value": "The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Insertion of Sensitive Information Into Sent Data",
"cweId": "CWE-201",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.38.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.38.2"
},
{
"version": "2.38.2",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.37.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.37.6"
},
{
"version": "2.37.6",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.36.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.36.9"
},
{
"version": "2.36.9",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.30.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.34.14"
},
{
"version": "2.34.14",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.24.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.29.23"
},
{
"version": "2.29.23",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.35.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.36.0"
},
{
"version": "2.36.0",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.38.0",
"versionEndExcluding": "2.38.2"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.37.0",
"versionEndExcluding": "2.37.6"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.36.0",
"versionEndExcluding": "2.36.9"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.30.0",
"versionEndExcluding": "2.34.14"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.24.0",
"versionEndExcluding": "2.29.23"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.35.0",
"versionEndExcluding": "2.36.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/coder/coder/security/advisories/GHSA-2x8w-q434-f76p",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-2x8w-q434-f76p)"
},
{
"name": "VulnCheck Advisory: Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.2-session-token-leak-via-sub-agent-external-apps"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "EhabY",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126309.json
+167
View File
@@ -0,0 +1,167 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126309",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:19.659Z",
"dateUpdated": "2026-11-13T09:36:19.659Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:19.659Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import",
"descriptions": [
{
"lang": "en",
"value": "OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "External Control of File Name or Path",
"cweId": "CWE-73",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "openbao",
"product": "openbao",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/openbao/openbao/v2",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.6.5"
},
{
"version": "2.6.5",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "2.7.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.7.2"
},
{
"version": "2.7.2",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.7.0",
"versionEndExcluding": "2.7.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-5pmx-2p74-x478",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-5pmx-2p74-x478)"
},
{
"name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-path-traversal-in-transit-key-import"
}
],
"credits": [
{
"lang": "en",
"value": "MarcIlunga",
"type": "reporter"
},
{
"lang": "en",
"value": "cipherboy",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126310.json
+167
View File
@@ -0,0 +1,167 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126310",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:18.944Z",
"dateUpdated": "2026-11-13T09:36:18.944Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:18.944Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials",
"descriptions": [
{
"lang": "en",
"value": "OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Authentication",
"cweId": "CWE-287",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "openbao",
"product": "openbao",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/openbao/openbao/v2",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.6.5"
},
{
"version": "2.6.5",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "2.7.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.7.2"
},
{
"version": "2.7.2",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.7.0",
"versionEndExcluding": "2.7.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-q824-44ff-f5j5",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-q824-44ff-f5j5)"
},
{
"name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-oidc-provider-authentication-bypass-via-client-credentials"
}
],
"credits": [
{
"lang": "en",
"value": "datosh",
"type": "reporter"
},
{
"lang": "en",
"value": "cipherboy",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126311.json
+172
View File
@@ -0,0 +1,172 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126311",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:18.274Z",
"dateUpdated": "2026-11-13T09:36:18.274Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:18.274Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates",
"descriptions": [
{
"lang": "en",
"value": "OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Wildcards or Matching Symbols",
"cweId": "CWE-155",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "openbao",
"product": "openbao",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/openbao/openbao/v2",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.6.5"
},
{
"version": "2.6.5",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "2.7.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.7.2"
},
{
"version": "2.7.2",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.7.0",
"versionEndExcluding": "2.7.2"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-h76r-48x5-36hg",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-h76r-48x5-36hg)"
},
{
"name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-wildcard-principals-in-ssh-certificates-via-identity-templates"
}
],
"credits": [
{
"lang": "en",
"value": "manus-pi",
"type": "reporter"
},
{
"lang": "en",
"value": "cipherboy",
"type": "remediation developer"
},
{
"lang": "en",
"value": "manus-use",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126312.json
+255
View File
@@ -0,0 +1,255 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126312",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:17.584Z",
"dateUpdated": "2026-11-13T09:36:17.584Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:17.584Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths",
"descriptions": [
{
"lang": "en",
"value": "OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Handling of Case Sensitivity",
"cweId": "CWE-178",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "openbao",
"product": "openbao",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/openbao/openbao/v2",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.6.5"
},
{
"version": "2.6.5",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "2.7.0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.7.2"
},
{
"version": "2.7.2",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "openbao",
"product": "openbao",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/ldap",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "0.2.0"
},
{
"version": "0.2.0",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "openbao",
"product": "openbao",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/radius",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "0.2.0"
},
{
"version": "0.2.0",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.7.0",
"versionEndExcluding": "2.7.2"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.0"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-736f-82w7-hj22)"
},
{
"name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths"
}
],
"credits": [
{
"lang": "en",
"value": "gn00295120",
"type": "reporter"
},
{
"lang": "en",
"value": "datosh",
"type": "reporter"
},
{
"lang": "en",
"value": "omar152002",
"type": "reporter"
},
{
"lang": "en",
"value": "ria-labs-security",
"type": "reporter"
},
{
"lang": "en",
"value": "HAN-BAMBO",
"type": "reporter"
},
{
"lang": "en",
"value": "cipherboy",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126313.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126313",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:16.853Z",
"dateUpdated": "2026-11-13T09:36:16.853Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:16.853Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "frappe",
"product": "hrms",
"defaultStatus": "unaffected",
"versions": [
{
"version": "16.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "16.20.1"
},
{
"version": "16.20.1",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-rh2j-fcxx-r67m",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-rh2j-fcxx-r67m)"
},
{
"name": "VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-authorization-bypass-via-employee-records"
}
],
"credits": [
{
"lang": "en",
"value": "Darshan060224",
"type": "finder"
},
{
"lang": "en",
"value": "deepeshgarg007",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126314.json
+157
View File
@@ -0,0 +1,157 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126314",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.991Z",
"datePublished": "2026-11-13T09:36:16.153Z",
"dateUpdated": "2026-11-13T09:36:16.153Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:16.153Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "frappe",
"product": "hrms",
"defaultStatus": "unaffected",
"versions": [
{
"version": "15.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "15.64.6"
},
{
"version": "15.64.6",
"status": "unaffected",
"versionType": "semver"
}
]
},
{
"vendor": "frappe",
"product": "hrms",
"defaultStatus": "unaffected",
"versions": [
{
"version": "16.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "16.20.1"
},
{
"version": "16.20.1",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-m8m7-r43p-2jjf",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-m8m7-r43p-2jjf)"
},
{
"name": "VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.6-missing-authorization-in-bulk-record-creation"
}
],
"credits": [
{
"lang": "en",
"value": "Darshan060224",
"type": "finder"
},
{
"lang": "en",
"value": "deepeshgarg007",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126315.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126315",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:15.474Z",
"dateUpdated": "2026-11-13T09:36:15.474Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:15.474Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Exposure of Private Personal Information to an Unauthorized Actor",
"cweId": "CWE-359",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "frappe",
"product": "hrms",
"defaultStatus": "unaffected",
"versions": [
{
"version": "16.14.0",
"status": "affected",
"versionType": "semver",
"lessThan": "16.20.1"
},
{
"version": "16.20.1",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-26gj-rr4j-3hgc",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-26gj-rr4j-3hgc)"
},
{
"name": "VulnCheck Advisory: Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-16.14.0-before-16.20.1-telemetry-setting-bypass-information-exposure"
}
],
"credits": [
{
"lang": "en",
"value": "Darshan060224",
"type": "finder"
},
{
"lang": "en",
"value": "deepeshgarg007",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126316.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126316",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:14.731Z",
"dateUpdated": "2026-11-13T09:36:14.731Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:14.731Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Use of GET Request Method With Sensitive Query Strings",
"cweId": "CWE-598",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "frappe",
"product": "hrms",
"defaultStatus": "unaffected",
"versions": [
{
"version": "16.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "16.20.1"
},
{
"version": "16.20.1",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.2,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-hphm-4mc5-m7gj",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-hphm-4mc5-m7gj)"
},
{
"name": "VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-subscription-key-exposure-via-request-url"
}
],
"credits": [
{
"lang": "en",
"value": "Darshan060224",
"type": "finder"
},
{
"lang": "en",
"value": "deepeshgarg007",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126317.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126317",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:14.050Z",
"dateUpdated": "2026-11-13T09:36:14.050Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:14.050Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "frappe",
"product": "hrms",
"defaultStatus": "unaffected",
"versions": [
{
"version": "16.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "16.20.1"
},
{
"version": "16.20.1",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-v72r-rg45-x9rh",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-v72r-rg45-x9rh)"
},
{
"name": "VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-missing-authorization-in-company-details-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "Darshan060224",
"type": "finder"
},
{
"lang": "en",
"value": "deepeshgarg007",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126318.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126318",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:13.376Z",
"dateUpdated": "2026-11-13T09:36:13.376Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:13.376Z"
},
"datePublic": "2026-10-25T00:00:00.000Z",
"title": "REDAXO before 5.21.6 Authorization Bypass of Live Version Permission",
"descriptions": [
{
"lang": "en",
"value": "REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "redaxo",
"product": "core",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "5.21.6"
},
{
"version": "5.21.6",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.21.6"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/redaxo/core/security/advisories/GHSA-6w5f-mr8f-5964",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-6w5f-mr8f-5964)"
},
{
"name": "VulnCheck Advisory: REDAXO before 5.21.6 Authorization Bypass of Live Version Permission",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/redaxo-before-5.21.6-authorization-bypass-of-live-version-permission"
}
],
"credits": [
{
"lang": "en",
"value": "skerbis",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126319.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126319",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:12.691Z",
"dateUpdated": "2026-11-13T09:36:12.691Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:12.691Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path",
"descriptions": [
{
"lang": "en",
"value": "Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Finsys",
"product": "dockhand",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "1.0.55"
},
{
"version": "1.0.55",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-q8p8-fhph-f9mj",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-q8p8-fhph-f9mj)"
},
{
"name": "VulnCheck Advisory: Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.55-arbitrary-file-read-via-stack-adoption-compose-path"
}
],
"credits": [
{
"lang": "en",
"value": "FelipeDuartee",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126320.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126320",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:12.031Z",
"dateUpdated": "2026-11-13T09:36:12.031Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:12.031Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Dockhand before 1.0.55 Improper Authorization via Container File Download Endpoint",
"descriptions": [
{
"lang": "en",
"value": "Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary container files instead of requiring containers:exec. Authenticated Enterprise RBAC users can request any path from the files/download endpoint, which reads through Docker's archive API, to retrieve secrets, keys, and mounted credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Authorization",
"cweId": "CWE-285",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Finsys",
"product": "dockhand",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "1.0.55"
},
{
"version": "1.0.55",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-r924-w2cm-9cjg",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-r924-w2cm-9cjg)"
},
{
"name": "VulnCheck Advisory: Dockhand before 1.0.55 Improper Authorization via Container File Download Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.55-improper-authorization-via-container-file-download-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "FelipeDuartee",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126321.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126321",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:11.349Z",
"dateUpdated": "2026-11-13T09:36:11.349Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:11.349Z"
},
"datePublic": "2026-10-26T00:00:00.000Z",
"title": "Dockhand before 1.0.55 Path Traversal via Symlink in File-Browser Endpoints",
"descriptions": [
{
"lang": "en",
"value": "Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser path guard by combining symlinks with '..' sequences. Attackers can read /proc/self/environ, the SQLite database, and the encryption key via /api/system/files/content, or move them using the stack relocate endpoint, exposing stored credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Finsys",
"product": "dockhand",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "1.0.55"
},
{
"version": "1.0.55",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-8vcv-cvj7-g5vx",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-8vcv-cvj7-g5vx)"
},
{
"name": "VulnCheck Advisory: Dockhand before 1.0.55 Path Traversal via Symlink in File-Browser Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.55-path-traversal-via-symlink-in-file-browser-endpoints"
}
],
"credits": [
{
"lang": "en",
"value": "FelipeDuartee",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126322.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126322",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:10.583Z",
"dateUpdated": "2026-11-13T09:36:10.583Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:10.583Z"
},
"datePublic": "2026-08-18T00:00:00.000Z",
"title": "OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php",
"descriptions": [
{
"lang": "en",
"value": "OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Deserialization of Untrusted Data",
"cweId": "CWE-502",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "openemr",
"product": "openemr",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "8.3.0"
},
{
"version": "8.3.0",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.3.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-r52j-mq9p-mh85",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-r52j-mq9p-mh85)"
},
{
"name": "VulnCheck Advisory: OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openemr-before-8.3.0-unsanitized-deserialization-via-patient-match-dialog-php"
}
],
"credits": [
{
"lang": "en",
"value": "nedlir",
"type": "reporter"
},
{
"lang": "en",
"value": "kojiromike",
"type": "remediation developer"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126323.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126323",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:09.910Z",
"dateUpdated": "2026-11-13T09:36:09.910Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:09.910Z"
},
"datePublic": "2026-10-29T00:00:00.000Z",
"title": "Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions",
"descriptions": [
{
"lang": "en",
"value": "Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Cross-Site Request Forgery (CSRF)",
"cweId": "CWE-352",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "givanz",
"product": "Vvveb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "1.0.8.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.8.6"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-grxp-rj92-j8xr",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-grxp-rj92-j8xr)"
},
{
"name": "VulnCheck Advisory: Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-csrf-via-get-admin-state-changing-actions"
}
],
"credits": [
{
"lang": "en",
"value": "vq4s",
"type": "finder"
},
{
"lang": "en",
"value": "fgetss",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126369.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126369",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:09.242Z",
"dateUpdated": "2026-11-13T09:36:09.242Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:09.242Z"
},
"datePublic": "2026-10-29T00:00:00.000Z",
"title": "Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass",
"descriptions": [
{
"lang": "en",
"value": "Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript&colon; entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "givanz",
"product": "Vvveb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "1.0.8.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.8.6"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-prqj-4768-vcmq",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-prqj-4768-vcmq)"
},
{
"name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-stored-xss-via-sanitizehtml-blacklist-bypass"
}
],
"credits": [
{
"lang": "en",
"value": "vq4s",
"type": "finder"
},
{
"lang": "en",
"value": "fgetss",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126370.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126370",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:08.557Z",
"dateUpdated": "2026-11-13T09:36:08.557Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:08.557Z"
},
"datePublic": "2026-10-29T00:00:00.000Z",
"title": "Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save",
"descriptions": [
{
"lang": "en",
"value": "Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incomplete List of Disallowed Inputs",
"cweId": "CWE-184",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "givanz",
"product": "Vvveb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "1.0.8.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.8.6"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-2mq4-4q7r-q52q",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-2mq4-4q7r-q52q)"
},
{
"name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-authenticated-rce-via-sql-code-injection-in-editor-code-save"
}
],
"credits": [
{
"lang": "en",
"value": "vq4s",
"type": "finder"
},
{
"lang": "en",
"value": "fgetss",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126371.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126371",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:07.876Z",
"dateUpdated": "2026-11-13T09:36:07.876Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:07.876Z"
},
"datePublic": "2026-10-29T00:00:00.000Z",
"title": "Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys",
"descriptions": [
{
"lang": "en",
"value": "Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "givanz",
"product": "Vvveb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "1.0.8.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.8.6"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-ffrq-8926-cpc9",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-ffrq-8926-cpc9)"
},
{
"name": "VulnCheck Advisory: Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-admin-auth-tokensql-update-array-keys"
}
],
"credits": [
{
"lang": "en",
"value": "TOzyTOl",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126372.json
+139
View File
@@ -0,0 +1,139 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126372",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:07.223Z",
"dateUpdated": "2026-11-13T09:36:07.223Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:07.223Z"
},
"datePublic": "2026-10-29T00:00:00.000Z",
"title": "Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code",
"descriptions": [
{
"lang": "en",
"value": "Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Unrestricted Upload of File with Dangerous Type",
"cweId": "CWE-434",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "givanz",
"product": "Vvveb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "1.0.8.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.8.6"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-7h6v-ww3f-24pp)"
},
{
"name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-template-upload-bypass-via-mediatrait-editor-code"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126373.json
+147
View File
@@ -0,0 +1,147 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126373",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:06.554Z",
"dateUpdated": "2026-11-13T09:36:06.554Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:06.554Z"
},
"datePublic": "2026-10-29T00:00:00.000Z",
"title": "Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions",
"descriptions": [
{
"lang": "en",
"value": "Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "givanz",
"product": "Vvveb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0.8.4",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "1.0.8.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.0.8.4",
"versionEndIncluding": "1.0.8.6"
}
]
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-7fg6-jfgq-56q9",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-7fg6-jfgq-56q9)"
},
{
"name": "VulnCheck Advisory: Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vvveb-1.0.8.4-through-1.0.8.6-authorization-bypass-via-post-revisions"
}
],
"credits": [
{
"lang": "en",
"value": "avrlab233",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126374.json
+132
View File
@@ -0,0 +1,132 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126374",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:05.890Z",
"dateUpdated": "2026-11-13T09:36:05.890Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T09:36:05.890Z"
},
"datePublic": "2026-10-29T00:00:00.000Z",
"title": "Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys",
"descriptions": [
{
"lang": "en",
"value": "Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"cweId": "CWE-89",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "givanz",
"product": "Vvveb",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "1.0.8.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.8.6"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-fwp9-mpg4-hh5w",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-fwp9-mpg4-hh5w)"
},
{
"name": "VulnCheck Advisory: Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-keys-each-array-keys"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
Loaded 100 of 338 files, more files were not shown because too many files have changed in this diff. Show more