diff --git a/data/2023/54xxx/CVE-2023-54423.json b/data/2023/54xxx/CVE-2023-54423.json
new file mode 100644
index 0000000000..e99d531f74
--- /dev/null
+++ b/data/2023/54xxx/CVE-2023-54423.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2023-54423",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:47:05.179Z",
+        "datePublished": "2026-11-13T09:37:04.518Z",
+        "dateUpdated": "2026-11-13T09:37:04.518Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:37:04.518Z"
+            },
+            "datePublic": "2023-12-08T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Script in Attributes of IMG Tags in a Web Page",
+                            "cweId": "CWE-82",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.2.0"
+                        },
+                        {
+                            "version": "20.2.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "LOW",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9j5w-2cqc-cwj9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9j5w-2cqc-cwj9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.2.0-stored-xss-via-tinymce-wysiwyg-editor"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "halitAKAYDIN",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2024/58xxx/CVE-2024-58404.json b/data/2024/58xxx/CVE-2024-58404.json
new file mode 100644
index 0000000000..d7ce7cf5bf
--- /dev/null
+++ b/data/2024/58xxx/CVE-2024-58404.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2024-58404",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:59:33.492Z",
+        "datePublished": "2026-11-13T09:37:03.888Z",
+        "dateUpdated": "2026-11-13T09:37:03.888Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:37:03.888Z"
+            },
+            "datePublic": "2024-09-12T00:00:00.000Z",
+            "title": "Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "3.4.5",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.7.10"
+                        },
+                        {
+                            "version": "3.7.10",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "3.4.5",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.7.10"
+                        },
+                        {
+                            "version": "3.7.10",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-v38v-92cm-6mx8)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "piprett",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2024/58xxx/CVE-2024-58405.json b/data/2024/58xxx/CVE-2024-58405.json
new file mode 100644
index 0000000000..a222ad7ef5
--- /dev/null
+++ b/data/2024/58xxx/CVE-2024-58405.json
@@ -0,0 +1,122 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2024-58405",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:59:38.607Z",
+        "datePublished": "2026-11-13T09:37:03.249Z",
+        "dateUpdated": "2026-11-13T09:37:03.249Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:37:03.249Z"
+            },
+            "datePublic": "2024-03-05T00:00:00.000Z",
+            "title": "Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "3.7.9"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-j2cw-9fvc-wr4r)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "resetd3v",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2025/71xxx/CVE-2025-71459.json b/data/2025/71xxx/CVE-2025-71459.json
new file mode 100644
index 0000000000..ed6250e67c
--- /dev/null
+++ b/data/2025/71xxx/CVE-2025-71459.json
@@ -0,0 +1,123 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2025-71459",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:58:40.540Z",
+        "datePublished": "2026-11-13T09:37:02.598Z",
+        "dateUpdated": "2026-11-13T09:37:02.598Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:37:02.598Z"
+            },
+            "datePublic": "2025-12-15T00:00:00.000Z",
+            "title": "Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/zipline",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.3.2"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4jm6-mgwv-fq63)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "DenizParlak",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2025/71xxx/CVE-2025-71460.json b/data/2025/71xxx/CVE-2025-71460.json
new file mode 100644
index 0000000000..ff87bb3dfe
--- /dev/null
+++ b/data/2025/71xxx/CVE-2025-71460.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2025-71460",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:59:01.582Z",
+        "datePublished": "2026-11-13T09:37:01.929Z",
+        "dateUpdated": "2026-11-13T09:37:01.929Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:37:01.929Z"
+            },
+            "datePublic": "2025-08-08T00:00:00.000Z",
+            "title": "Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.2.1"
+                        },
+                        {
+                            "version": "4.2.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "attackComplexity": "HIGH",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 4.2,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
+                        "version": "3.1"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-26wv-mhc3-5xfq",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-26wv-mhc3-5xfq)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.2.1-missing-ownership-check-via-api-user-files-transaction"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "smashedr",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2025/71xxx/CVE-2025-71461.json b/data/2025/71xxx/CVE-2025-71461.json
new file mode 100644
index 0000000000..fcd0724899
--- /dev/null
+++ b/data/2025/71xxx/CVE-2025-71461.json
@@ -0,0 +1,114 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2025-71461",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:59:05.981Z",
+        "datePublished": "2026-11-13T09:37:01.263Z",
+        "dateUpdated": "2026-11-13T09:37:01.263Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:37:01.263Z"
+            },
+            "datePublic": "2025-03-19T00:00:00.000Z",
+            "title": "Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
+                            "cweId": "CWE-338",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6rg9-q9ww-w2rw)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "allc",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2025/71xxx/CVE-2025-71462.json b/data/2025/71xxx/CVE-2025-71462.json
new file mode 100644
index 0000000000..f91c130ba1
--- /dev/null
+++ b/data/2025/71xxx/CVE-2025-71462.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2025-71462",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:59:26.621Z",
+        "datePublished": "2026-11-13T09:37:00.586Z",
+        "dateUpdated": "2026-11-13T09:37:00.586Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:37:00.586Z"
+            },
+            "datePublic": "2025-01-31T00:00:00.000Z",
+            "title": "Zipline before 3.7.12 XSS via url parameter on login page",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.7.12"
+                        },
+                        {
+                            "version": "3.7.12",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "NONE",
+                        "scope": "CHANGED",
+                        "userInteraction": "REQUIRED",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-m288-p6wr-m6gv)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 3.7.12 XSS via url parameter on login page",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2025/71xxx/CVE-2025-71463.json b/data/2025/71xxx/CVE-2025-71463.json
new file mode 100644
index 0000000000..bc9e7dd488
--- /dev/null
+++ b/data/2025/71xxx/CVE-2025-71463.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2025-71463",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T23:12:43.913Z",
+        "datePublished": "2026-11-13T09:36:59.897Z",
+        "dateUpdated": "2026-11-13T09:36:59.897Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:59.897Z"
+            },
+            "datePublic": "2025-10-22T00:00:00.000Z",
+            "title": "Scapy before 2.7.0 Insecure Deserialization RCE via Session Files",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__()."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Deserialization of Untrusted Data",
+                            "cweId": "CWE-502",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "secdev",
+                    "product": "scapy",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/scapy",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.7.0"
+                        },
+                        {
+                            "version": "2.7.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:scapy:scapy:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.7.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.7,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-cq46-m9x9-j8w2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Scapy before 2.7.0 Insecure Deserialization RCE via Session Files",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "anotherik",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/103xxx/CVE-2026-103645.json b/data/2026/103xxx/CVE-2026-103645.json
new file mode 100644
index 0000000000..8e3802c447
--- /dev/null
+++ b/data/2026/103xxx/CVE-2026-103645.json
@@ -0,0 +1,204 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-103645",
+        "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
+        "state": "PUBLISHED",
+        "assignerShortName": "Qt",
+        "dateReserved": "2026-10-01T06:20:58.674Z",
+        "datePublished": "2026-11-13T09:36:23.530Z",
+        "dateUpdated": "2026-11-13T09:36:23.530Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
+                "shortName": "Qt",
+                "dateUpdated": "2026-11-13T09:36:23.530Z"
+            },
+            "title": "Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt",
+            "datePublic": "2026-11-13T09:30:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-190",
+                            "description": "CWE-190 Integer Overflow or Wraparound",
+                            "type": "CWE"
+                        }
+                    ]
+                },
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-835",
+                            "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "impacts": [
+                {
+                    "capecId": "CAPEC-92",
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "value": "CAPEC-92 Forced Integer Overflow"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "qt",
+                    "product": "qt",
+                    "modules": [
+                        "qtbase",
+                        "qt5compat"
+                    ],
+                    "versions": [
+                        {
+                            "status": "unknown",
+                            "version": "0",
+                            "lessThan": "5.0.0",
+                            "versionType": "python"
+                        },
+                        {
+                            "status": "affected",
+                            "version": "5.0.0",
+                            "lessThan": "6.8.9",
+                            "versionType": "python"
+                        },
+                        {
+                            "status": "affected",
+                            "version": "6.9.0",
+                            "lessThan": "6.11.3",
+                            "versionType": "python"
+                        }
+                    ],
+                    "defaultStatus": "unaffected",
+                    "cpes": [
+                        "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
+                        "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*",
+                        "cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*"
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "operator": "OR",
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "5.0.0",
+                                    "versionEndExcluding": "6.8.9"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "6.9.0",
+                                    "versionEndExcluding": "6.11.3"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "5.0.0",
+                                    "versionEndExcluding": "6.0.0"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "6.0.0",
+                                    "versionEndExcluding": "6.8.9"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "6.9.0",
+                                    "versionEndExcluding": "6.11.3"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "<p>An integer overflow vulnerability in the Qt <code>QTextCodec</code> <code>fromUnicode()</code> and <code>toUnicode()</code> functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.</p>"
+                        }
+                    ]
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.qt.io/security-advisories?search=CVE-2026-103645",
+                    "tags": [
+                        "vendor-advisory"
+                    ]
+                },
+                {
+                    "url": "https://codereview.qt-project.org/c/qt/qt5compat/+/762795",
+                    "tags": [
+                        "patch"
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV4_0": {
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "exploitMaturity": "UNREPORTED",
+                        "Safety": "NOT_DEFINED",
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "USER",
+                        "valueDensity": "NOT_DEFINED",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED",
+                        "providerUrgency": "CLEAR",
+                        "version": "4.0",
+                        "baseSeverity": "LOW",
+                        "baseScore": 1.1,
+                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:U/U:Clear"
+                    }
+                }
+            ],
+            "source": {
+                "discovery": "INTERNAL"
+            },
+            "x_generator": {
+                "engine": "Vulnogram 1.0.5"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/106xxx/CVE-2026-106172.json b/data/2026/106xxx/CVE-2026-106172.json
index b86ca3a953..089336dae5 100644
--- a/data/2026/106xxx/CVE-2026-106172.json
+++ b/data/2026/106xxx/CVE-2026-106172.json
@@ -8,7 +8,7 @@
         "assignerShortName": "fortinet",
         "dateReserved": "2026-10-06T16:19:44.280Z",
         "datePublished": "2026-10-13T17:37:16.459Z",
-        "dateUpdated": "2026-11-06T15:42:03.991Z"
+        "dateUpdated": "2026-11-13T10:04:26.266Z"
     },
     "containers": {
         "cna": {
@@ -64,9 +64,12 @@
                     "vendor": "Fortinet",
                     "product": "FortiSandbox Cloud",
                     "cpes": [
+                        "cpe:2.3:a:fortinet:fortisandboxcloud:5.2.1:*:*:*:*:*:*:*",
+                        "cpe:2.3:a:fortinet:fortisandboxcloud:5.2.0:*:*:*:*:*:*:*",
                         "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.6:*:*:*:*:*:*:*",
                         "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*",
                         "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*",
+                        "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.3:*:*:*:*:*:*:*",
                         "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.2:*:*:*:*:*:*:*",
                         "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.1:*:*:*:*:*:*:*",
                         "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.0:*:*:*:*:*:*:*",
@@ -85,14 +88,14 @@
                     "versions": [
                         {
                             "versionType": "semver",
-                            "version": "5.0.4",
-                            "lessThanOrEqual": "5.0.6",
+                            "version": "5.2.0",
+                            "lessThanOrEqual": "5.2.1",
                             "status": "affected"
                         },
                         {
                             "versionType": "semver",
                             "version": "5.0.0",
-                            "lessThanOrEqual": "5.0.2",
+                            "lessThanOrEqual": "5.0.6",
                             "status": "affected"
                         },
                         {
@@ -107,13 +110,13 @@
             "descriptions": [
                 {
                     "lang": "en",
-                    "value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.0.4 through 5.0.6, FortiSandbox Cloud 5.0.0 through 5.0.2, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests"
+                    "value": "A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests"
                 }
             ],
             "providerMetadata": {
                 "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
                 "shortName": "fortinet",
-                "dateUpdated": "2026-11-06T15:42:03.991Z"
+                "dateUpdated": "2026-11-13T10:04:26.266Z"
             },
             "problemTypes": [
                 {
@@ -149,7 +152,7 @@
             "solutions": [
                 {
                     "lang": "en",
-                    "value": "Upgrade to FortiSandbox version 5.2.2 or above\nUpgrade to FortiSandbox version 5.0.7 or above\nUpgrade to FortiSandbox Cloud version 5.2.2 or above"
+                    "value": "Upgrade to FortiSandbox version 5.2.2 or above\nUpgrade to FortiSandbox version 5.0.7 or above\nUpgrade to FortiSandbox Cloud version 5.2.2 or above\nUpgrade to FortiSandbox Cloud version 5.0.7 or above"
                 }
             ],
             "references": [
diff --git a/data/2026/112xxx/CVE-2026-112181.json b/data/2026/112xxx/CVE-2026-112181.json
new file mode 100644
index 0000000000..6756cc0f2c
--- /dev/null
+++ b/data/2026/112xxx/CVE-2026-112181.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-112181",
+        "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
+        "state": "PUBLISHED",
+        "assignerShortName": "INCIBE",
+        "dateReserved": "2026-10-19T09:03:18.525Z",
+        "datePublished": "2026-11-13T09:54:21.059Z",
+        "dateUpdated": "2026-11-13T10:13:21.512Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
+                "shortName": "INCIBE",
+                "dateUpdated": "2026-11-13T10:13:21.512Z"
+            },
+            "title": "Multiple Vulnerabilities in OpenKM Community Edition",
+            "datePublic": "2026-11-13T09:36:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-611",
+                            "description": "CWE-611 Improper restriction of XML external entity reference",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenKM",
+                    "product": "OpenKM Community Edition",
+                    "versions": [
+                        {
+                            "status": "affected",
+                            "version": "6.3.3",
+                            "lessThanOrEqual": "6.3.13",
+                            "versionType": "custom"
+                        },
+                        {
+                            "status": "affected",
+                            "version": "7.0.3"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "operator": "OR",
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openkm:openkm_community_edition:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "6.3.3",
+                                    "versionEndIncluding": "6.3.13"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openkm:openkm_community_edition:7.0.3:*:*:*:*:*:*:*"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server."
+                        }
+                    ]
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV4_0": {
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "subConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "valueDensity": "NOT_DEFINED",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED",
+                        "providerUrgency": "NOT_DEFINED",
+                        "version": "4.0",
+                        "baseSeverity": "HIGH",
+                        "baseScore": 8.3,
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
+                    }
+                }
+            ],
+            "solutions": [
+                {
+                    "lang": "en",
+                    "value": "Update OpenKM CE 7.0.3 to 7.0.4, which has already been released. According to the manufacturer, the entity resolver has been fixed, and general and parameter external entities have been disabled by enabling FEATURE_SECURE_PROCESSING. For versions 6.3.3 through 6.3.13, the fix will be included in 6.3.14, which is pending release; HTTP requests for non-local DTDs have also been removed.\n\n\nAs a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.\n\n\n\nThe manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "<span>Update OpenKM CE 7.0.3 to 7.0.4, which has already been released. According to the manufacturer, the entity resolver has been fixed, and general and parameter external entities have been disabled by enabling FEATURE_SECURE_PROCESSING. For versions 6.3.3 through 6.3.13, the fix will be included in 6.3.14, which is pending release; HTTP requests for non-local DTDs have also been removed.</span><div><span><br></span></div><div><span>As a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.</span></div><div><div><p>The manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.</p></div></div>"
+                        }
+                    ]
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Carlos Alejandro Smith Tay (Las3rs)",
+                    "type": "finder"
+                }
+            ],
+            "source": {
+                "discovery": "EXTERNAL"
+            },
+            "x_generator": {
+                "engine": "Vulnogram 1.0.5"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/112xxx/CVE-2026-112182.json b/data/2026/112xxx/CVE-2026-112182.json
new file mode 100644
index 0000000000..72ce6be18d
--- /dev/null
+++ b/data/2026/112xxx/CVE-2026-112182.json
@@ -0,0 +1,153 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-112182",
+        "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
+        "state": "PUBLISHED",
+        "assignerShortName": "INCIBE",
+        "dateReserved": "2026-10-19T09:03:19.676Z",
+        "datePublished": "2026-11-13T10:11:27.327Z",
+        "dateUpdated": "2026-11-13T10:11:27.327Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
+                "shortName": "INCIBE",
+                "dateUpdated": "2026-11-13T10:11:27.327Z"
+            },
+            "title": "Multiple Vulnerabilities in OpenKM Community Edition",
+            "datePublic": "2026-11-13T09:57:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-862",
+                            "description": "CWE-862 Missing Authorization",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenKM",
+                    "product": "OpenKM Community Edition",
+                    "versions": [
+                        {
+                            "status": "affected",
+                            "version": "6.3.12"
+                        },
+                        {
+                            "status": "affected",
+                            "version": "6.3.13"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "operator": "OR",
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openkm:openkm_community_edition:6.3.12:*:*:*:*:*:*:*"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openkm:openkm_community_edition:6.3.13:*:*:*:*:*:*:*"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root."
+                        }
+                    ]
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV4_0": {
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "valueDensity": "NOT_DEFINED",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED",
+                        "providerUrgency": "NOT_DEFINED",
+                        "version": "4.0",
+                        "baseSeverity": "HIGH",
+                        "baseScore": 8.7,
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+                    }
+                }
+            ],
+            "solutions": [
+                {
+                    "lang": "en",
+                    "value": "Update to OpenKM CE 6.3.14 when it becomes available. The vendor states that creating and deleting process definitions will require the administrator role at the business layer, covering REST, SOAP, and the administration interface.\n\n\nAs a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.\n\n\n\nThe manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "<span>Update to OpenKM CE 6.3.14 when it becomes available. The vendor states that creating and deleting process definitions will require the administrator role at the business layer, covering REST, SOAP, and the administration interface.</span><div><br><div><p>As a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.</p><p>The manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.</p></div></div>"
+                        }
+                    ]
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Carlos Alejandro Smith Tay (Las3rs)",
+                    "type": "finder"
+                }
+            ],
+            "source": {
+                "discovery": "EXTERNAL"
+            },
+            "x_generator": {
+                "engine": "Vulnogram 1.0.5"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/115xxx/CVE-2026-115871.json b/data/2026/115xxx/CVE-2026-115871.json
new file mode 100644
index 0000000000..ff32497b0d
--- /dev/null
+++ b/data/2026/115xxx/CVE-2026-115871.json
@@ -0,0 +1,106 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-115871",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-10-23T18:33:00.912Z",
+        "datePublished": "2026-11-13T09:35:10.951Z",
+        "dateUpdated": "2026-11-13T09:35:10.951Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:10.951Z"
+            },
+            "affected": [
+                {
+                    "vendor": "renehermi",
+                    "product": "WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "4.19.0",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."
+                }
+            ],
+            "title": "WP STAGING <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-73 External Control of File Name or Path",
+                            "cweId": "CWE-73",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
+                        "baseScore": 2.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-12T21:00:20.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116418.json b/data/2026/116xxx/CVE-2026-116418.json
new file mode 100644
index 0000000000..ce05dae085
--- /dev/null
+++ b/data/2026/116xxx/CVE-2026-116418.json
@@ -0,0 +1,102 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-116418",
+        "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+        "state": "PUBLISHED",
+        "assignerShortName": "dell",
+        "dateReserved": "2026-10-26T10:04:27.243Z",
+        "datePublished": "2026-11-13T09:20:16.351Z",
+        "dateUpdated": "2026-11-13T09:20:16.351Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+                "shortName": "dell",
+                "dateUpdated": "2026-11-13T09:20:16.351Z"
+            },
+            "datePublic": "2026-11-03T06:30:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-863",
+                            "description": "CWE-863: Incorrect Authorization",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Dell",
+                    "product": "PowerScale InsightIQ",
+                    "versions": [
+                        {
+                            "status": "affected",
+                            "version": "0",
+                            "lessThan": "6.4.1 or later",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."
+                        }
+                    ]
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities",
+                    "tags": [
+                        "vendor-advisory"
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseSeverity": "HIGH",
+                        "baseScore": 7.5,
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
+                    }
+                }
+            ],
+            "source": {
+                "discovery": "UNKNOWN"
+            },
+            "x_generator": {
+                "engine": "Vulnogram 1.0.5"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116433.json b/data/2026/116xxx/CVE-2026-116433.json
new file mode 100644
index 0000000000..181dfa7ddd
--- /dev/null
+++ b/data/2026/116xxx/CVE-2026-116433.json
@@ -0,0 +1,102 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-116433",
+        "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+        "state": "PUBLISHED",
+        "assignerShortName": "dell",
+        "dateReserved": "2026-10-26T10:04:27.244Z",
+        "datePublished": "2026-11-13T09:16:36.792Z",
+        "dateUpdated": "2026-11-13T09:16:36.792Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+                "shortName": "dell",
+                "dateUpdated": "2026-11-13T09:16:36.792Z"
+            },
+            "datePublic": "2026-11-03T06:30:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-862",
+                            "description": "CWE-862: Missing Authorization",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Dell",
+                    "product": "PowerScale InsightIQ",
+                    "versions": [
+                        {
+                            "status": "affected",
+                            "version": "0",
+                            "lessThan": "6.4.1 or later",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."
+                        }
+                    ]
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities",
+                    "tags": [
+                        "vendor-advisory"
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseSeverity": "MEDIUM",
+                        "baseScore": 4.3,
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
+                    }
+                }
+            ],
+            "source": {
+                "discovery": "UNKNOWN"
+            },
+            "x_generator": {
+                "engine": "Vulnogram 1.0.5"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116509.json b/data/2026/116xxx/CVE-2026-116509.json
new file mode 100644
index 0000000000..0b06c8b170
--- /dev/null
+++ b/data/2026/116xxx/CVE-2026-116509.json
@@ -0,0 +1,103 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-116509",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-10-26T13:13:50.719Z",
+        "datePublished": "2026-11-13T09:35:15.539Z",
+        "dateUpdated": "2026-11-13T09:35:15.539Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:15.539Z"
+            },
+            "affected": [
+                {
+                    "vendor": "expresstech",
+                    "product": "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "11.2.9",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call."
+                }
+            ],
+            "title": "Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/classes/class-qmn-quiz-manager.php#L688"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1187"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1193"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/options-page-questions-tab.php#L1209"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.9/php/admin/functions.php#L1135"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3779826%40quiz-master-next&new=3779826%40quiz-master-next"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-12T20:51:37.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116614.json b/data/2026/116xxx/CVE-2026-116614.json
new file mode 100644
index 0000000000..9c0eb3e825
--- /dev/null
+++ b/data/2026/116xxx/CVE-2026-116614.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-116614",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-10-26T16:56:43.367Z",
+        "datePublished": "2026-11-13T09:35:13.682Z",
+        "dateUpdated": "2026-11-13T09:35:13.682Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:13.682Z"
+            },
+            "affected": [
+                {
+                    "vendor": "aukejomm",
+                    "product": "WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "2.24.1",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to generic SQL Injection via the 'sourceId' parameter in all versions up to, and including, 2.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The plugin grants the edit_feeds capability to the Editor role on activation, meaning any Editor-level user satisfies the authorization checks and can exploit this vulnerability."
+                }
+            ],
+            "title": "WPMR Google Feed Manager for WooCommerce <= 2.24.1 - Authenticated (Editor+) SQL Injection via 'sourceId' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7cecb044-2dba-494f-b85c-41bafa69e330?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php#L42"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-ajax-data.php#L59"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.1/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php#L64"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3792176"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/tags/2.24.2/includes/packages/review-feed-manager/classes/class-wpprfm-queries.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
+                        "baseScore": 4.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-10-26T17:14:10.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:59:39.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116615.json b/data/2026/116xxx/CVE-2026-116615.json
new file mode 100644
index 0000000000..1509753413
--- /dev/null
+++ b/data/2026/116xxx/CVE-2026-116615.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-116615",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-10-26T16:58:35.221Z",
+        "datePublished": "2026-11-13T09:35:12.566Z",
+        "dateUpdated": "2026-11-13T09:35:12.566Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:12.566Z"
+            },
+            "affected": [
+                {
+                    "vendor": "marketingfire",
+                    "product": "Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "4.2.6.1",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!--start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping — persisting the payload verbatim to the database — while the render-side `str_replace` reconstitutes the key to `class`, feeding the attacker-controlled `logic` value directly into `@eval`. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary `get_option`, `get_user_meta`, and `get_post_meta` values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the `widgetopts_allowed_php_functions` filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes `widgetopts_safe_eval_trusted()` to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above."
+                }
+            ],
+            "title": "Widget Options <= 4.2.6.1 - Authenticated (Contributor+) Code Injection via 'post_content' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5e4431-2789-47c8-81ce-e9f67454accc?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L496"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L331"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/widgets/gutenberg/gutenberg-toolbar.php#L377"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.6.1/includes/extras.php#L792"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/widget-options/tags/4.2.7/includes/widgets/gutenberg/gutenberg-toolbar.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-94 Improper Control of Generation of Code",
+                            "cweId": "CWE-94",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-10-26T17:15:25.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:59:16.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/118xxx/CVE-2026-118191.json b/data/2026/118xxx/CVE-2026-118191.json
new file mode 100644
index 0000000000..12ba342c12
--- /dev/null
+++ b/data/2026/118xxx/CVE-2026-118191.json
@@ -0,0 +1,108 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-118191",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-10-27T18:53:29.970Z",
+        "datePublished": "2026-11-13T09:35:15.166Z",
+        "dateUpdated": "2026-11-13T09:35:15.166Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:15.166Z"
+            },
+            "affected": [
+                {
+                    "vendor": "smub",
+                    "product": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "4.5.5",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The 'NextGEN Manage gallery' capability required to reach the vulnerable endpoint is granted to Administrators by default but can be delegated to lower-privileged roles via the plugin's Roles screen."
+                }
+            ],
+            "title": "Photo Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e01402-f866-43b9-9fef-7e9b156a9e0d?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2943"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2764"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L164"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.3/src/Lightroom/Controller.php#L2395"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3793263/nextgen-gallery/trunk/src/Lightroom/Controller.php?old=3773860&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FLightroom%2FController.php"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3793263/nextgen-gallery/trunk/src/Lightroom/Controller.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-10-27T19:08:59.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:54:54.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/118xxx/CVE-2026-118587.json b/data/2026/118xxx/CVE-2026-118587.json
new file mode 100644
index 0000000000..6cd180b359
--- /dev/null
+++ b/data/2026/118xxx/CVE-2026-118587.json
@@ -0,0 +1,102 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-118587",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-10-28T16:15:20.499Z",
+        "datePublished": "2026-11-13T09:35:18.085Z",
+        "dateUpdated": "2026-11-13T09:35:18.085Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:18.085Z"
+            },
+            "affected": [
+                {
+                    "vendor": "blubrry",
+                    "product": "PowerPress Podcasting plugin by Blubrry",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "11.18.0",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayer_build_html5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own."
+                }
+            ],
+            "title": "PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d3930f-d2da-4992-ad3a-228ffd7a5a6c?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L1240"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L135"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/powerpress?rev=3782100#trunk"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3782099/powerpress/trunk/powerpress-player.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-10-28T16:30:48.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:54:59.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/119xxx/CVE-2026-119077.json b/data/2026/119xxx/CVE-2026-119077.json
new file mode 100644
index 0000000000..757fbd7c22
--- /dev/null
+++ b/data/2026/119xxx/CVE-2026-119077.json
@@ -0,0 +1,114 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-119077",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-10-29T13:09:51.023Z",
+        "datePublished": "2026-11-13T09:35:17.360Z",
+        "dateUpdated": "2026-11-13T09:35:17.360Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:17.360Z"
+            },
+            "affected": [
+                {
+                    "vendor": "elextensions",
+                    "product": "ELEX WordPress HelpDesk & Customer Ticketing System",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "3.3.9",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack."
+                }
+            ],
+            "title": "ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f14b07ce-8893-4f8c-a501-5da6ec5a3b8f?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L822"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L156"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L265"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L627"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions.php#L946"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php#L45"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L529"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3797458/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-public-functions.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-502 Deserialization of Untrusted Data",
+                            "cweId": "CWE-502",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "baseScore": 9.8,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Osman Hussein"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-10-29T13:22:59.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:10:29.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/120xxx/CVE-2026-120547.json b/data/2026/120xxx/CVE-2026-120547.json
new file mode 100644
index 0000000000..7a28e929b5
--- /dev/null
+++ b/data/2026/120xxx/CVE-2026-120547.json
@@ -0,0 +1,108 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-120547",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-02T16:24:41.752Z",
+        "datePublished": "2026-11-13T09:35:11.842Z",
+        "dateUpdated": "2026-11-13T09:35:11.842Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:11.842Z"
+            },
+            "affected": [
+                {
+                    "vendor": "saadiqbal",
+                    "product": "CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "3.8.0",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability."
+                }
+            ],
+            "title": "CF7 Apps <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3091d345-2532-433c-83e0-2e253a4cd8d4?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L415"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L440"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L392"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L488"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-honeypot/tags/3.8.0/legacy-honeypot/includes/honeypot4cf7.php#L341"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3772728%40contact-form-7-honeypot&new=3772728%40contact-form-7-honeypot"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 4.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-10-01T03:38:34.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:50:08.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/120xxx/CVE-2026-120573.json b/data/2026/120xxx/CVE-2026-120573.json
new file mode 100644
index 0000000000..ed070f3427
--- /dev/null
+++ b/data/2026/120xxx/CVE-2026-120573.json
@@ -0,0 +1,102 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-120573",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-02T16:39:41.029Z",
+        "datePublished": "2026-11-13T09:35:15.899Z",
+        "dateUpdated": "2026-11-13T09:35:15.899Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:15.899Z"
+            },
+            "affected": [
+                {
+                    "vendor": "etruel",
+                    "product": "WPeMatico RSS Feed Fetcher",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "2.9.1",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaign_data, bypassing wp_kses sanitization, and executes in the browser session of any user with edit_posts — including Administrators — who opens the WPeMatico campaigns list screen."
+                }
+            ],
+            "title": "WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d93d4360-b66c-499a-838c-e8eea36bd364?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaigns_list.php#L820"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/wpematico_functions.php#L1106"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaign_edit.php#L540"
+                },
+                {
+                    "url": "https://github.com/etruel/wpematico/tree/2.9.2"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-10-30T16:24:41.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:59:31.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/120xxx/CVE-2026-120658.json b/data/2026/120xxx/CVE-2026-120658.json
new file mode 100644
index 0000000000..1e01a90628
--- /dev/null
+++ b/data/2026/120xxx/CVE-2026-120658.json
@@ -0,0 +1,102 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-120658",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-02T18:43:02.986Z",
+        "datePublished": "2026-11-13T09:35:14.804Z",
+        "dateUpdated": "2026-11-13T09:35:14.804Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:14.804Z"
+            },
+            "affected": [
+                {
+                    "vendor": "codename065",
+                    "product": "Download Manager",
+                    "versions": [
+                        {
+                            "version": "6.0.0",
+                            "status": "affected",
+                            "lessThanOrEqual": "7.6.3",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_previews][]' parameter in all versions up to, and including, 7.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpdm_sanitize_array() function strips HTML tags via wp_kses but leaves bare single quotes intact and calls stripslashes_deep() which defeats WordPress magic quotes protection, allowing a single-quote-based attribute breakout payload to be stored verbatim and later rendered without escaping."
+                }
+            ],
+            "title": "Download Manager <= 7.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4085834-3865-4b9e-9497-f14e6e32554b?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/PackageController.php#L2296"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L169"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L113"
+                },
+                {
+                    "url": "https://www.wpdownloadmanager.com/changelogs/"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-02T18:58:14.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:48:27.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/120xxx/CVE-2026-120688.json b/data/2026/120xxx/CVE-2026-120688.json
new file mode 100644
index 0000000000..4a85344a74
--- /dev/null
+++ b/data/2026/120xxx/CVE-2026-120688.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-120688",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-02T19:24:28.770Z",
+        "datePublished": "2026-11-13T09:35:12.209Z",
+        "dateUpdated": "2026-11-13T09:35:12.209Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:12.209Z"
+            },
+            "affected": [
+                {
+                    "vendor": "scheeeli",
+                    "product": "EZ SQL Reports Shortcode Widget and DB Backup",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "5.25.25",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation."
+                }
+            ],
+            "title": "EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.25 - Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/376eec5d-a629-4765-8ace-09e21bf3c2e8?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L385"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L419"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L517"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/elisqlreports/trunk"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3791213/elisqlreports/trunk/index.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Adrien Brunner"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-02T19:40:25.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:11:24.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/121xxx/CVE-2026-121518.json b/data/2026/121xxx/CVE-2026-121518.json
new file mode 100644
index 0000000000..72c6b5ccef
--- /dev/null
+++ b/data/2026/121xxx/CVE-2026-121518.json
@@ -0,0 +1,117 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-121518",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-03T14:25:35.591Z",
+        "datePublished": "2026-11-13T09:35:16.266Z",
+        "dateUpdated": "2026-11-13T09:35:16.266Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:16.266Z"
+            },
+            "affected": [
+                {
+                    "vendor": "ivole",
+                    "product": "Customer Reviews for WooCommerce",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "5.127.0",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring."
+                }
+            ],
+            "title": "Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L26"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L584"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L407"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L24"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L284"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L159"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L175"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3791702/"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3791702/customer-reviews-woocommerce/trunk/includes/blocks/class-cr-all-reviews.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Shon Bida"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-03T14:42:23.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:10:05.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/122xxx/CVE-2026-122063.json b/data/2026/122xxx/CVE-2026-122063.json
new file mode 100644
index 0000000000..b915c7b558
--- /dev/null
+++ b/data/2026/122xxx/CVE-2026-122063.json
@@ -0,0 +1,114 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-122063",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-04T16:46:09.007Z",
+        "datePublished": "2026-11-13T09:35:12.949Z",
+        "dateUpdated": "2026-11-13T09:35:12.949Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:12.949Z"
+            },
+            "affected": [
+                {
+                    "vendor": "contrid",
+                    "product": "Newsletters",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "4.18.2",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the admin-controlled 'currentusersubscribed' option to be enabled and at least one page rendering the Newsletters subscribe shortcode or widget to exist; a Subscriber-level attacker can self-serve the attack by updating their own profile email to a crafted payload and loading such a page."
+                }
+            ],
+            "title": "Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/68348c03-d0ba-4dcc-8b18-a4675d6dce27?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default/subscribe.php#L552"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default/widget.php#L12"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default2/subscribe.php#L571"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/views/default2/widget.php#L12"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.2/helpers/shortcode.php#L1416"
+                },
+                {
+                    "url": "https://wordpress.org/plugins/newsletters-lite/"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3794975/newsletters-lite/trunk/views/default/subscribe.php"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3794975%40newsletters-lite&new=3794975%40newsletters-lite"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-04T17:02:50.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:04:45.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/122xxx/CVE-2026-122227.json b/data/2026/122xxx/CVE-2026-122227.json
new file mode 100644
index 0000000000..b72d029019
--- /dev/null
+++ b/data/2026/122xxx/CVE-2026-122227.json
@@ -0,0 +1,111 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-122227",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-04T20:43:42.608Z",
+        "datePublished": "2026-11-13T09:35:16.630Z",
+        "dateUpdated": "2026-11-13T09:35:16.630Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:16.630Z"
+            },
+            "affected": [
+                {
+                    "vendor": "mervb1",
+                    "product": "Easy Property Listings",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "3.5.28",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field() function is applied to the attribute value but does not escape single quotes, providing no mitigation against breaking out of the SQL IN('...') literal."
+                }
+            ],
+            "title": "Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0389e2-ab65-4652-a3e9-521dfd2e54a8?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L1851"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/widgets/widget-functions.php#L390"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/templates/content/shortcodes/listing-search/default.php#L119"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/shortcodes/shortcode-listing-search.php#L30"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L1859"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.28/lib/includes/functions.php#L2349"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/easy-property-listings/tags/3.5.29"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-04T20:59:25.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:02:46.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/123xxx/CVE-2026-123769.json b/data/2026/123xxx/CVE-2026-123769.json
new file mode 100644
index 0000000000..225c911b6b
--- /dev/null
+++ b/data/2026/123xxx/CVE-2026-123769.json
@@ -0,0 +1,108 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-123769",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-06T13:59:04.747Z",
+        "datePublished": "2026-11-13T09:35:11.454Z",
+        "dateUpdated": "2026-11-13T09:35:11.454Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:11.454Z"
+            },
+            "affected": [
+                {
+                    "vendor": "brainstormforce",
+                    "product": "SureDash – Community, Courses & Member Dashboard",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "1.13.0",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role."
+                }
+            ],
+            "title": "SureDash <= 1.13.0 - Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f317dcd-dc4f-482a-8faa-91cd9c022276?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/sanitizer.php#L101"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/settings.php#L604"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/services/router.php#L108"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/backend.php#L1309"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/social-logins.php#L472"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3794229/suredash/trunk/core/routers/backend.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-269 Improper Privilege Management",
+                            "cweId": "CWE-269",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-06T14:15:26.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:55:05.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124218.json b/data/2026/124xxx/CVE-2026-124218.json
new file mode 100644
index 0000000000..2388c18b42
--- /dev/null
+++ b/data/2026/124xxx/CVE-2026-124218.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-124218",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-06T22:32:02.354Z",
+        "datePublished": "2026-11-13T09:35:16.995Z",
+        "dateUpdated": "2026-11-13T09:35:16.995Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:16.995Z"
+            },
+            "affected": [
+                {
+                    "vendor": "addonsorg",
+                    "product": "Drag and Drop File Upload for Elementor Forms",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "1.6.2",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the \"yeepdf_not_save\" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path."
+                }
+            ],
+            "title": "Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee73bfb0-843c-4b4a-b513-3980c1cefac1?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L838"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L764"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L724"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L849"
+                },
+                {
+                    "url": "https://downloads.wordpress.org/plugin/drag-and-drop-file-upload-for-elementor-forms.1.6.3.zip"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "nh4tvd"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-06T22:47:18.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:09:58.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125055.json b/data/2026/125xxx/CVE-2026-125055.json
new file mode 100644
index 0000000000..ac322b4e86
--- /dev/null
+++ b/data/2026/125xxx/CVE-2026-125055.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-125055",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-09T16:27:26.174Z",
+        "datePublished": "2026-11-13T09:35:13.330Z",
+        "dateUpdated": "2026-11-13T09:35:13.330Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:13.330Z"
+            },
+            "affected": [
+                {
+                    "vendor": "sameh101",
+                    "product": "Chatterbug Forms – Fast, Flexible WordPress Form Builder",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "1.0.2",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier."
+                }
+            ],
+            "title": "Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L422"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L331"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L510"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L308"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3794492/chatterbug-forms/trunk/chatterbug-forms.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
+                            "cweId": "CWE-434",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "baseScore": 9.8,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "samathakeeling"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-10T08:32:15.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:10:49.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125409.json b/data/2026/125xxx/CVE-2026-125409.json
new file mode 100644
index 0000000000..5f894297db
--- /dev/null
+++ b/data/2026/125xxx/CVE-2026-125409.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-125409",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-09T22:24:31.767Z",
+        "datePublished": "2026-11-13T09:35:14.057Z",
+        "dateUpdated": "2026-11-13T09:35:14.057Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:14.057Z"
+            },
+            "affected": [
+                {
+                    "vendor": "wpchill",
+                    "product": "Passster – Password Protect Pages and Content",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "4.3.21",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passster_id or passster_headline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by do_shortcode() — bypassing the per-attribute escaping present inside render_shortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filter_the_content() has no edit-permission capability gate."
+                }
+            ],
+            "title": "Passster <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81cf06d2-9b5a-4f9f-adf9-890b46db7783?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L417"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L429"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/class-ps-public.php#L294"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/content-protector/tags/4.3.21/inc/admin/inc/class-ps-meta.php#L82"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3793918/content-protector/trunk/inc/class-ps-public.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-09T22:39:46.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:48:11.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125948.json b/data/2026/125xxx/CVE-2026-125948.json
new file mode 100644
index 0000000000..58393fbc86
--- /dev/null
+++ b/data/2026/125xxx/CVE-2026-125948.json
@@ -0,0 +1,108 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-125948",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-10T14:27:30.419Z",
+        "datePublished": "2026-11-13T09:35:14.454Z",
+        "dateUpdated": "2026-11-13T09:35:14.454Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:14.454Z"
+            },
+            "affected": [
+                {
+                    "vendor": "wpzoom",
+                    "product": "Recipe Card Blocks Lite",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "3.7.0",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post() preserves block-delimiter HTML comments verbatim on save, a Contributor can embed event-handler payloads inside the block's steps[].text attribute in a draft or pending post without the unfiltered_html capability, and the payload executes for any visitor — including privileged editors and administrators who preview or publish the post — as well as through the public print endpoint."
+                }
+            ],
+            "title": "Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed1f200-d4ae-4c9e-a618-fbeb58c0f3f3?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L184"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L1999"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L63"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L90"
+                },
+                {
+                    "url": "https://wordpress.org/plugins/recipe-card-blocks-by-wpzoom/#developers"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3794649/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-steps.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-10T14:43:44.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T20:54:40.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126029.json b/data/2026/126xxx/CVE-2026-126029.json
new file mode 100644
index 0000000000..51d5d0b6a4
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126029.json
@@ -0,0 +1,108 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126029",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2026-11-10T16:10:43.832Z",
+        "datePublished": "2026-11-13T09:35:17.735Z",
+        "dateUpdated": "2026-11-13T09:35:17.735Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2026-11-13T09:35:17.735Z"
+            },
+            "affected": [
+                {
+                    "vendor": "wpzoom",
+                    "product": "WPZOOM Addons for Elementor – Starter Templates & Widgets",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "lessThanOrEqual": "1.4.20",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+                }
+            ],
+            "title": "WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f25b6009-0edb-4acd-97a3-c24e6e51fecc?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L1103"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L891"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/world-map.php#L1057"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.4.20/includes/widgets/world-map/frontend.js#L72"
+                },
+                {
+                    "url": "https://wordpress.org/plugins/wpzoom-elementor-addons/#developers"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3795911/wpzoom-elementor-addons/trunk/includes/widgets/world-map/world-map.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "Wordfence PRISM"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2026-11-10T16:25:59.000Z",
+                    "lang": "en",
+                    "value": "Vendor Notified"
+                },
+                {
+                    "time": "2026-11-12T21:00:10.000Z",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126264.json b/data/2026/126xxx/CVE-2026-126264.json
new file mode 100644
index 0000000000..24eabc4c9d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126264.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126264",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.556Z",
+        "datePublished": "2026-11-13T09:36:51.089Z",
+        "dateUpdated": "2026-11-13T09:36:51.089Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:51.089Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "siyuan-note",
+                    "product": "siyuan",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/siyuan",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.8.9"
+                        },
+                        {
+                            "version": "3.8.9",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.8.9"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3pm7-cc76-7j2p",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3pm7-cc76-7j2p)"
+                },
+                {
+                    "url": "https://github.com/siyuan-note/siyuan/commit/d122dee55e8d3c77de313d0ad6efae8b6b0ebc07",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.9-sensitive-file-disclosure-via-api-file-getfile"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "rexpository",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126265.json b/data/2026/126xxx/CVE-2026-126265.json
new file mode 100644
index 0000000000..843aa196d0
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126265.json
@@ -0,0 +1,146 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126265",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.556Z",
+        "datePublished": "2026-11-13T09:36:50.432Z",
+        "dateUpdated": "2026-11-13T09:36:50.432Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:50.432Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Restriction of Excessive Authentication Attempts",
+                            "cweId": "CWE-307",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "siyuan-note",
+                    "product": "siyuan",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
+                    "versions": [
+                        {
+                            "version": "2.1.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.8.9"
+                        },
+                        {
+                            "version": "3.8.9",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.1.0",
+                                    "versionEndExcluding": "3.8.9"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-23g4-vqq8-5764",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-23g4-vqq8-5764)"
+                },
+                {
+                    "name": "VulnCheck Advisory: SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.9-captcha-bypass-via-stale-login-cookie"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "rexpository",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126266.json b/data/2026/126xxx/CVE-2026-126266.json
new file mode 100644
index 0000000000..cfd9f766f8
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126266.json
@@ -0,0 +1,146 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126266",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.556Z",
+        "datePublished": "2026-11-13T09:36:49.770Z",
+        "dateUpdated": "2026-11-13T09:36:49.770Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:49.770Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "siyuan-note",
+                    "product": "siyuan",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/SiYuan",
+                    "versions": [
+                        {
+                            "version": "3.6.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.8.9"
+                        },
+                        {
+                            "version": "3.8.9",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.6.0",
+                                    "versionEndExcluding": "3.8.9"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qf37-w288-frvq",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qf37-w288-frvq)"
+                },
+                {
+                    "name": "VulnCheck Advisory: SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/siyuan-from-3.6.0-before-3.8.9-publish-password-bypass-via-getdoc-regex-keywords"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "rexpository",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126267.json b/data/2026/126xxx/CVE-2026-126267.json
new file mode 100644
index 0000000000..8746c89332
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126267.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126267",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.557Z",
+        "datePublished": "2026-11-13T09:36:49.116Z",
+        "dateUpdated": "2026-11-13T09:36:49.116Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:49.116Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Input Validation",
+                            "cweId": "CWE-20",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0.300.0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.04.4"
+                        },
+                        {
+                            "version": "2026.04.4",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.300.0",
+                                    "versionEndExcluding": "2026.04.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-gcxw-8q43-jhjc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-gcxw-8q43-jhjc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-from-0.300.0-before-2026.04.4-denial-of-service-via-metaservice-logging"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "5255fgh",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126268.json b/data/2026/126xxx/CVE-2026-126268.json
new file mode 100644
index 0000000000..cd247aab5f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126268.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126268",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.557Z",
+        "datePublished": "2026-11-13T09:36:48.470Z",
+        "dateUpdated": "2026-11-13T09:36:48.470Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:48.470Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Origin Validation Error",
+                            "cweId": "CWE-346",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-2rm5-wf7w-8j57",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2rm5-wf7w-8j57)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-ip-address-spoofing-via-unconditional-proxy-trust"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "5255fgh",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126269.json b/data/2026/126xxx/CVE-2026-126269.json
new file mode 100644
index 0000000000..82b914d2e1
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126269.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126269",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.557Z",
+        "datePublished": "2026-11-13T09:36:47.840Z",
+        "dateUpdated": "2026-11-13T09:36:47.840Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:47.840Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.09.0"
+                        },
+                        {
+                            "version": "2026.09.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.09.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.3,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3f7w-wqf7-786q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3f7w-wqf7-786q)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-stored-xss-via-attachment-mime-type"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "PratibhaDevi29",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126270.json b/data/2026/126xxx/CVE-2026-126270.json
new file mode 100644
index 0000000000..5df99327f7
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126270.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126270",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.557Z",
+        "datePublished": "2026-11-13T09:36:47.205Z",
+        "dateUpdated": "2026-11-13T09:36:47.205Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:47.205Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authentication for Critical Function",
+                            "cweId": "CWE-306",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.09.1"
+                        },
+                        {
+                            "version": "2026.09.1",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.09.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-5892-3964-gc52",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-5892-3964-gc52)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.1-unauthenticated-information-disclosure-via-aggregated-meta-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "ya3raj",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126271.json b/data/2026/126xxx/CVE-2026-126271.json
new file mode 100644
index 0000000000..a90c784757
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126271.json
@@ -0,0 +1,137 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126271",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.557Z",
+        "datePublished": "2026-11-13T09:36:46.548Z",
+        "dateUpdated": "2026-11-13T09:36:46.548Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:46.548Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficiently Protected Credentials",
+                            "cweId": "CWE-522",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.09.0"
+                        },
+                        {
+                            "version": "2026.09.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.09.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-rjc4-j36j-gjjc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rjc4-j36j-gjjc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-tls-private-key-exposure-via-data-source-read"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126272.json b/data/2026/126xxx/CVE-2026-126272.json
new file mode 100644
index 0000000000..bb7ff3083e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126272.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126272",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.557Z",
+        "datePublished": "2026-11-13T09:36:45.727Z",
+        "dateUpdated": "2026-11-13T09:36:45.727Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:45.727Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.09.0"
+                        },
+                        {
+                            "version": "2026.09.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.09.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-mmvm-m83w-6684",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mmvm-m83w-6684)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-uncontrolled-resource-consumption-via-bulk-record-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "iaohkut-from-NightWolf-Team",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126273.json b/data/2026/126xxx/CVE-2026-126273.json
new file mode 100644
index 0000000000..f97939d467
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126273.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126273",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:13:22.557Z",
+        "datePublished": "2026-11-13T09:36:45.077Z",
+        "dateUpdated": "2026-11-13T09:36:45.077Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:45.077Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Privilege Management",
+                            "cweId": "CWE-269",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.09.0"
+                        },
+                        {
+                            "version": "2026.09.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.09.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "attackVector": "NETWORK",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "HIGH",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-mjxv-r6j7-m8gv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mjxv-r6j7-m8gv)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-privilege-escalation-via-incomplete-admin-bootstrap"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126274.json b/data/2026/126xxx/CVE-2026-126274.json
new file mode 100644
index 0000000000..5350c8b4fb
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126274.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126274",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.971Z",
+        "datePublished": "2026-11-13T09:36:44.396Z",
+        "dateUpdated": "2026-11-13T09:36:44.396Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:44.396Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.3,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-638g-xw92-xq9x)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "cy3erm",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126275.json b/data/2026/126xxx/CVE-2026-126275.json
new file mode 100644
index 0000000000..824cc4f79a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126275.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126275",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:43.720Z",
+        "dateUpdated": "2026-11-13T09:36:43.720Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:43.720Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.09.0 IDOR in Row Comment Operations",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.09.0"
+                        },
+                        {
+                            "version": "2026.09.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.09.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x3xv-qpw2-33x6",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-x3xv-qpw2-33x6)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.09.0 IDOR in Row Comment Operations",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-idor-in-row-comment-operations"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "bwbugs",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "Fla4sh",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126276.json b/data/2026/126xxx/CVE-2026-126276.json
new file mode 100644
index 0000000000..8f535ac633
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126276.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126276",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:43.031Z",
+        "dateUpdated": "2026-11-13T09:36:43.031Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:43.031Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Authentication",
+                            "cweId": "CWE-287",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.1"
+                        },
+                        {
+                            "version": "2026.08.1",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-4cx5-q9xx-5pgj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4cx5-q9xx-5pgj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-client-authentication-bypass-via-oauth-token-exchange"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "mantraak",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126277.json b/data/2026/126xxx/CVE-2026-126277.json
new file mode 100644
index 0000000000..1f6a14cf64
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126277.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126277",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:42.352Z",
+        "dateUpdated": "2026-11-13T09:36:42.352Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:42.352Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.1"
+                        },
+                        {
+                            "version": "2026.08.1",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-2j2m-jqcx-2q2j",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2j2m-jqcx-2q2j)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-uncontrolled-resource-consumption-via-shared-view-bulk-api"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "pavanchow",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126278.json b/data/2026/126xxx/CVE-2026-126278.json
new file mode 100644
index 0000000000..69c30a1ed6
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126278.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126278",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:41.678Z",
+        "dateUpdated": "2026-11-13T09:36:41.678Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:41.678Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.1 Password Reset Token Race Condition",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
+                            "cweId": "CWE-362",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.1"
+                        },
+                        {
+                            "version": "2026.08.1",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-7mf9-q77p-r4r3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-7mf9-q77p-r4r3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.1 Password Reset Token Race Condition",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-password-reset-token-race-condition"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "NinjaGPT",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126279.json b/data/2026/126xxx/CVE-2026-126279.json
new file mode 100644
index 0000000000..8ce6ecd98e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126279.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126279",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:40.988Z",
+        "dateUpdated": "2026-11-13T09:36:40.988Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:40.988Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.06.2"
+                        },
+                        {
+                            "version": "2026.06.2",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.06.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-j96w-qm45-vgp2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-j96w-qm45-vgp2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-stored-xss-via-ai-field-prompt-tooltip"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "geo-chen",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126280.json b/data/2026/126xxx/CVE-2026-126280.json
new file mode 100644
index 0000000000..81708f4f00
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126280.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126280",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:39.321Z",
+        "dateUpdated": "2026-11-13T09:36:39.321Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:39.321Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
+                            "cweId": "CWE-362",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-mh65-9xcf-vf8v",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mh65-9xcf-vf8v)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-refresh-token-reuse-via-non-atomic-rotation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "komyunghan",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126281.json b/data/2026/126xxx/CVE-2026-126281.json
new file mode 100644
index 0000000000..abe45800f8
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126281.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126281",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:38.488Z",
+        "dateUpdated": "2026-11-13T09:36:38.488Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:38.488Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-355h-p2mj-vwc9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-355h-p2mj-vwc9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-private-integration-credential-exposure-via-copy"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "komyunghan",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126282.json b/data/2026/126xxx/CVE-2026-126282.json
new file mode 100644
index 0000000000..6165d155ab
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126282.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126282",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:37.841Z",
+        "dateUpdated": "2026-11-13T09:36:37.841Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:37.841Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Privilege Management",
+                            "cweId": "CWE-269",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "2026.04.0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2026.04.0",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-jj94-6wwc-qhcx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "komyunghan",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126283.json b/data/2026/126xxx/CVE-2026-126283.json
new file mode 100644
index 0000000000..aa28098b10
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126283.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126283",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:14:15.972Z",
+        "datePublished": "2026-11-13T09:36:37.190Z",
+        "dateUpdated": "2026-11-13T09:36:37.190Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:37.190Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-7395-6gh4-5q8p",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-7395-6gh4-5q8p)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-incorrect-authorization-via-base-scoped-api-tokens"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "komyunghan",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126284.json b/data/2026/126xxx/CVE-2026-126284.json
new file mode 100644
index 0000000000..c5e0097273
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126284.json
@@ -0,0 +1,138 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126284",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.178Z",
+        "datePublished": "2026-11-13T09:36:36.525Z",
+        "dateUpdated": "2026-11-13T09:36:36.525Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:36.525Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Server-Side Request Forgery (SSRF)",
+                            "cweId": "CWE-918",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "2026.05.2",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.07.0"
+                        },
+                        {
+                            "version": "2026.07.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2026.05.2",
+                                    "versionEndExcluding": "2026.07.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.1,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-6q3f-6mpq-cqgc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6q3f-6mpq-cqgc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-2026.05.2-before-2026.07.0-ssrf-via-data-import-url-fetch"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126285.json b/data/2026/126xxx/CVE-2026-126285.json
new file mode 100644
index 0000000000..8a1786b4ae
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126285.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126285",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.178Z",
+        "datePublished": "2026-11-13T09:36:35.854Z",
+        "dateUpdated": "2026-11-13T09:36:35.854Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:35.854Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-f2jp-xg6f-hjf6",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-f2jp-xg6f-hjf6)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-sql-injection-via-legacy-where-query-filter"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "tikket1",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126286.json b/data/2026/126xxx/CVE-2026-126286.json
new file mode 100644
index 0000000000..56c59b605f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126286.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126286",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.178Z",
+        "datePublished": "2026-11-13T09:36:35.200Z",
+        "dateUpdated": "2026-11-13T09:36:35.200Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:35.200Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.08.0"
+                        },
+                        {
+                            "version": "2026.08.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.08.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x3wx-294c-4p48",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-x3wx-294c-4p48)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-reflected-xss-via-ncredirecturl-in-pageleavingwarning-vue"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "dhairya7760",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126287.json b/data/2026/126xxx/CVE-2026-126287.json
new file mode 100644
index 0000000000..1069e887eb
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126287.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126287",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.178Z",
+        "datePublished": "2026-11-13T09:36:34.544Z",
+        "dateUpdated": "2026-11-13T09:36:34.544Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:34.544Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
+                            "cweId": "CWE-362",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.06.2"
+                        },
+                        {
+                            "version": "2026.06.2",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.06.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-353r-pj87-54hc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-353r-pj87-54hc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-oauth-refresh-token-rotation-race-condition"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "bytejmp",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126288.json b/data/2026/126xxx/CVE-2026-126288.json
new file mode 100644
index 0000000000..5969092f4c
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126288.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126288",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.179Z",
+        "datePublished": "2026-11-13T09:36:33.855Z",
+        "dateUpdated": "2026-11-13T09:36:33.855Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:33.855Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.06.2"
+                        },
+                        {
+                            "version": "2026.06.2",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.06.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-rmx6-f46x-5hhx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rmx6-f46x-5hhx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-credential-disclosure-via-public-oauth-client-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "bytejmp",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126289.json b/data/2026/126xxx/CVE-2026-126289.json
new file mode 100644
index 0000000000..f8e89a5ace
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126289.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126289",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.179Z",
+        "datePublished": "2026-11-13T09:36:33.112Z",
+        "dateUpdated": "2026-11-13T09:36:33.112Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:33.112Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Formula Elements in a CSV File",
+                            "cweId": "CWE-1236",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.06.1"
+                        },
+                        {
+                            "version": "2026.06.1",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.06.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8wgf-24mr-w88q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8wgf-24mr-w88q)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-csv-formula-injection-via-export-service-ts"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "hunntr",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126290.json b/data/2026/126xxx/CVE-2026-126290.json
new file mode 100644
index 0000000000..7e5ccf384e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126290.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126290",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.179Z",
+        "datePublished": "2026-11-13T09:36:32.519Z",
+        "dateUpdated": "2026-11-13T09:36:32.519Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:32.519Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.07.0"
+                        },
+                        {
+                            "version": "2026.07.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.07.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-wxxj-mghf-33v4",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wxxj-mghf-33v4)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.07.0-private-integration-credential-exposure-via-base-integration-read"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "watermelon1221",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "meifukun",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126291.json b/data/2026/126xxx/CVE-2026-126291.json
new file mode 100644
index 0000000000..59a95b265c
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126291.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126291",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.179Z",
+        "datePublished": "2026-11-13T09:36:31.871Z",
+        "dateUpdated": "2026-11-13T09:36:31.871Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:31.871Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.06.2"
+                        },
+                        {
+                            "version": "2026.06.2",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.06.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8qgc-rxmx-p7cw",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8qgc-rxmx-p7cw)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-sql-injection-via-user-email-in-base-user-query"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "PhilipPhil",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126292.json b/data/2026/126xxx/CVE-2026-126292.json
new file mode 100644
index 0000000000..bd02b9d560
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126292.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126292",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.179Z",
+        "datePublished": "2026-11-13T09:36:31.185Z",
+        "dateUpdated": "2026-11-13T09:36:31.185Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:31.185Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.06.1"
+                        },
+                        {
+                            "version": "2026.06.1",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.06.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-q5wf-7cr7-72h3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-q5wf-7cr7-72h3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-password-hash-exposure-via-profile-update-response"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "geo-chen",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126293.json b/data/2026/126xxx/CVE-2026-126293.json
new file mode 100644
index 0000000000..4849e22c55
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126293.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126293",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:03.179Z",
+        "datePublished": "2026-11-13T09:36:30.505Z",
+        "dateUpdated": "2026-11-13T09:36:30.505Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:30.505Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nocodb",
+                    "product": "nocodb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "2026.06.2"
+                        },
+                        {
+                            "version": "2026.06.2",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2026.06.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-cxj6-g54p-jwxp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-cxj6-g54p-jwxp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-attachment-size-limit-bypass-via-upload-by-url"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "DavidCarliez",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126294.json b/data/2026/126xxx/CVE-2026-126294.json
new file mode 100644
index 0000000000..2df4b5e5e6
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126294.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126294",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:29.863Z",
+        "dateUpdated": "2026-11-13T09:36:29.863Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:29.863Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Authentication",
+                            "cweId": "CWE-287",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "getgrav",
+                    "product": "grav",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.11.0"
+                        },
+                        {
+                            "version": "3.11.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.11.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4x9h-4683-5fcx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4x9h-4683-5fcx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/grav-login-plugin-before-3.11.0-two-factor-authentication-bypass-via-login"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126295.json b/data/2026/126xxx/CVE-2026-126295.json
new file mode 100644
index 0000000000..048008ce12
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126295.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126295",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:29.196Z",
+        "dateUpdated": "2026-11-13T09:36:29.196Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:29.196Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "3.10.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.10.0",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fg9w-wfp5-j933)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-arbitrary-file-read-via-bllipparser-model-paths"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126296.json b/data/2026/126xxx/CVE-2026-126296.json
new file mode 100644
index 0000000000..31e5140273
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126296.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126296",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:28.517Z",
+        "dateUpdated": "2026-11-13T09:36:28.517Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:28.517Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "External Control of File Name or Path",
+                            "cweId": "CWE-73",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-59f9-gqg8-mqpj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-59f9-gqg8-mqpj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-path-traversal-via-save-maxent-params-and-load-maxent-params"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "F0DH1L",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126297.json b/data/2026/126xxx/CVE-2026-126297.json
new file mode 100644
index 0000000000..a8fbbc2ea0
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126297.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126297",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:27.884Z",
+        "dateUpdated": "2026-11-13T09:36:27.884Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:27.884Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Resource Consumption",
+                            "cweId": "CWE-400",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-v8f3-6phw-6mh9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-v8f3-6phw-6mh9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-cpu-denial-of-service-via-conllcorpusreader-srl-instances"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126298.json b/data/2026/126xxx/CVE-2026-126298.json
new file mode 100644
index 0000000000..17c9ebb761
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126298.json
@@ -0,0 +1,150 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126298",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:27.213Z",
+        "dateUpdated": "2026-11-13T09:36:27.213Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:27.213Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Resource Consumption",
+                            "cweId": "CWE-400",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-r53h-rw34-8h97",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-r53h-rw34-8h97)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-cpu-denial-of-service-via-tree-chomsky-normal-form"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126299.json b/data/2026/126xxx/CVE-2026-126299.json
new file mode 100644
index 0000000000..c90bec52d8
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126299.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126299",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:26.544Z",
+        "dateUpdated": "2026-11-13T09:36:26.544Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:26.544Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Resource Consumption",
+                            "cweId": "CWE-400",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-89p3-fcch-88ph",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-89p3-fcch-88ph)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-time-denial-of-service-via-ccg-lexicon-fromstring"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126300.json b/data/2026/126xxx/CVE-2026-126300.json
new file mode 100644
index 0000000000..e3ebd5fee2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126300.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126300",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:25.918Z",
+        "dateUpdated": "2026-11-13T09:36:25.918Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:25.918Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Inefficient Algorithmic Complexity",
+                            "cweId": "CWE-407",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "3.2.5",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.2.5",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-ffr9-mgrr-wcvr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-ffr9-mgrr-wcvr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-from-3.2.5-before-3.10.4-cpu-exhaustion-via-treebankwordtokenizer-span-tokenize"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126301.json b/data/2026/126xxx/CVE-2026-126301.json
new file mode 100644
index 0000000000..1a629619c3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126301.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126301",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.612Z",
+        "datePublished": "2026-11-13T09:36:25.223Z",
+        "dateUpdated": "2026-11-13T09:36:25.223Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:25.223Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Inefficient Algorithmic Complexity",
+                            "cweId": "CWE-407",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "3.6",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.6",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-gpwc-27cw-rh9r",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-gpwc-27cw-rh9r)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-from-3.6-before-3.10.4-quadratic-cpu-exhaustion-via-legalitysyllabletokenizer-tokenize"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126302.json b/data/2026/126xxx/CVE-2026-126302.json
new file mode 100644
index 0000000000..61c6713982
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126302.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126302",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.613Z",
+        "datePublished": "2026-11-13T09:36:24.559Z",
+        "dateUpdated": "2026-11-13T09:36:24.559Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:24.559Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Link Resolution Before File Access ('Link Following')",
+                            "cweId": "CWE-59",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "3.9.4",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.9.4",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "LOCAL",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.3,
+                        "baseSeverity": "LOW",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "version": "3.1"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-xmfg-f9cm-w86q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-xmfg-f9cm-w86q)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-3.9.4-before-3.10.4-symlink-sandbox-escape-via-chat80-sql-query"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126303.json b/data/2026/126xxx/CVE-2026-126303.json
new file mode 100644
index 0000000000..28489801a3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126303.json
@@ -0,0 +1,150 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126303",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:15:54.613Z",
+        "datePublished": "2026-11-13T09:36:23.874Z",
+        "dateUpdated": "2026-11-13T09:36:23.874Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:23.874Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Resource Consumption",
+                            "cweId": "CWE-400",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-8fx7-8jr8-84rv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8fx7-8jr8-84rv)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-before-3.10.4-denial-of-service-via-steppingrecursivedescentparser-parse"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126304.json b/data/2026/126xxx/CVE-2026-126304.json
new file mode 100644
index 0000000000..77342b6e9e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126304.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126304",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:23.105Z",
+        "dateUpdated": "2026-11-13T09:36:23.105Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:23.105Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Link Resolution Before File Access ('Link Following')",
+                            "cweId": "CWE-59",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nltk",
+                    "product": "nltk",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/nltk",
+                    "versions": [
+                        {
+                            "version": "3.10.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.10.4"
+                        },
+                        {
+                            "version": "3.10.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.10.0",
+                                    "versionEndExcluding": "3.10.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nltk/nltk/security/advisories/GHSA-qg35-44qx-7vrr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qg35-44qx-7vrr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-symlink-escape-in-ycoecorpusreader"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126305.json b/data/2026/126xxx/CVE-2026-126305.json
new file mode 100644
index 0000000000..244740b2dd
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126305.json
@@ -0,0 +1,178 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126305",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:22.424Z",
+        "dateUpdated": "2026-11-13T09:36:22.424Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:22.424Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "espocrm",
+                    "product": "espocrm",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "10.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "10.0.9"
+                        },
+                        {
+                            "version": "10.0.9",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "espocrm",
+                    "product": "espocrm",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "9.3.11"
+                        },
+                        {
+                            "version": "9.3.11",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "10.0.0",
+                                    "versionEndExcluding": "10.0.9"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "9.3.11"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.5,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.3,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-j6q5-9jwj-9p8q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-j6q5-9jwj-9p8q)"
+                },
+                {
+                    "name": "VulnCheck Advisory: EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/espocrm-before-10.0.9-stored-xss-via-knowledge-base-article-attachments"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Paius-George",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126306.json b/data/2026/126xxx/CVE-2026-126306.json
new file mode 100644
index 0000000000..fcef4ceb40
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126306.json
@@ -0,0 +1,178 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126306",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:21.753Z",
+        "dateUpdated": "2026-11-13T09:36:21.753Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:21.753Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "espocrm",
+                    "product": "espocrm",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "10.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "10.0.8"
+                        },
+                        {
+                            "version": "10.0.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "espocrm",
+                    "product": "espocrm",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "9.3.11"
+                        },
+                        {
+                            "version": "9.3.11",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "10.0.0",
+                                    "versionEndExcluding": "10.0.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "9.3.11"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-4qv5-q4g7-hp5r",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4qv5-q4g7-hp5r)"
+                },
+                {
+                    "name": "VulnCheck Advisory: EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/espocrm-before-10.0.8-stored-xss-via-malicious-svg-attachment"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "AdamKorcz",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126307.json b/data/2026/126xxx/CVE-2026-126307.json
new file mode 100644
index 0000000000..9742eb72b1
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126307.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126307",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:21.073Z",
+        "dateUpdated": "2026-11-13T09:36:21.073Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:21.073Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "nezhahq",
+                    "product": "nezha",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/nezhahq/nezha",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.6.0"
+                        },
+                        {
+                            "version": "2.6.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-63mg-cxm4-98q3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-63mg-cxm4-98q3)"
+                },
+                {
+                    "url": "https://github.com/nezhahq/nezha/commit/027bfcf6521f192635b946b7583c3ab39500ab98",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/nezhahq/nezha/commit/7cd0371b56f7bce83c3953b2bf4711b2105d5818",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/nezha-dashboard-before-2.6.0-multiple-authorization-and-tenant-isolation-flaws"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "chaconneX",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126308.json b/data/2026/126xxx/CVE-2026-126308.json
new file mode 100644
index 0000000000..15f82e78d2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126308.json
@@ -0,0 +1,326 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126308",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:20.400Z",
+        "dateUpdated": "2026-11-13T09:36:20.400Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:20.400Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insertion of Sensitive Information Into Sent Data",
+                            "cweId": "CWE-201",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.38.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.38.2"
+                        },
+                        {
+                            "version": "2.38.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.37.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.37.6"
+                        },
+                        {
+                            "version": "2.37.6",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.36.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.9"
+                        },
+                        {
+                            "version": "2.36.9",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.30.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.34.14"
+                        },
+                        {
+                            "version": "2.34.14",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.24.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.29.23"
+                        },
+                        {
+                            "version": "2.29.23",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.35.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.0"
+                        },
+                        {
+                            "version": "2.36.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.38.0",
+                                    "versionEndExcluding": "2.38.2"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.37.0",
+                                    "versionEndExcluding": "2.37.6"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.36.0",
+                                    "versionEndExcluding": "2.36.9"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.30.0",
+                                    "versionEndExcluding": "2.34.14"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.24.0",
+                                    "versionEndExcluding": "2.29.23"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.35.0",
+                                    "versionEndExcluding": "2.36.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/coder/coder/security/advisories/GHSA-2x8w-q434-f76p",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2x8w-q434-f76p)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.2-session-token-leak-via-sub-agent-external-apps"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "EhabY",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126309.json b/data/2026/126xxx/CVE-2026-126309.json
new file mode 100644
index 0000000000..189eba4a2f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126309.json
@@ -0,0 +1,167 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126309",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:19.659Z",
+        "dateUpdated": "2026-11-13T09:36:19.659Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:19.659Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "External Control of File Name or Path",
+                            "cweId": "CWE-73",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openbao",
+                    "product": "openbao",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/openbao/openbao/v2",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.6.5"
+                        },
+                        {
+                            "version": "2.6.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.7.2"
+                        },
+                        {
+                            "version": "2.7.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.6.5"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.7.0",
+                                    "versionEndExcluding": "2.7.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openbao/openbao/security/advisories/GHSA-5pmx-2p74-x478",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-5pmx-2p74-x478)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-path-traversal-in-transit-key-import"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "MarcIlunga",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "cipherboy",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126310.json b/data/2026/126xxx/CVE-2026-126310.json
new file mode 100644
index 0000000000..68a416217d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126310.json
@@ -0,0 +1,167 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126310",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:18.944Z",
+        "dateUpdated": "2026-11-13T09:36:18.944Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:18.944Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Authentication",
+                            "cweId": "CWE-287",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openbao",
+                    "product": "openbao",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/openbao/openbao/v2",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.6.5"
+                        },
+                        {
+                            "version": "2.6.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.7.2"
+                        },
+                        {
+                            "version": "2.7.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.6.5"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.7.0",
+                                    "versionEndExcluding": "2.7.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openbao/openbao/security/advisories/GHSA-q824-44ff-f5j5",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-q824-44ff-f5j5)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-oidc-provider-authentication-bypass-via-client-credentials"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "datosh",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "cipherboy",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126311.json b/data/2026/126xxx/CVE-2026-126311.json
new file mode 100644
index 0000000000..822829e889
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126311.json
@@ -0,0 +1,172 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126311",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:18.274Z",
+        "dateUpdated": "2026-11-13T09:36:18.274Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:18.274Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Wildcards or Matching Symbols",
+                            "cweId": "CWE-155",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openbao",
+                    "product": "openbao",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/openbao/openbao/v2",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.6.5"
+                        },
+                        {
+                            "version": "2.6.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.7.2"
+                        },
+                        {
+                            "version": "2.7.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.6.5"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.7.0",
+                                    "versionEndExcluding": "2.7.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openbao/openbao/security/advisories/GHSA-h76r-48x5-36hg",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-h76r-48x5-36hg)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-wildcard-principals-in-ssh-certificates-via-identity-templates"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-pi",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "cipherboy",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126312.json b/data/2026/126xxx/CVE-2026-126312.json
new file mode 100644
index 0000000000..56e23dcf93
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126312.json
@@ -0,0 +1,255 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126312",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:17.584Z",
+        "dateUpdated": "2026-11-13T09:36:17.584Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:17.584Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Handling of Case Sensitivity",
+                            "cweId": "CWE-178",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openbao",
+                    "product": "openbao",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/openbao/openbao/v2",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.6.5"
+                        },
+                        {
+                            "version": "2.6.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.7.2"
+                        },
+                        {
+                            "version": "2.7.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "openbao",
+                    "product": "openbao",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/ldap",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.2.0"
+                        },
+                        {
+                            "version": "0.2.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "openbao",
+                    "product": "openbao",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/openbao/openbao-plugins/auth/radius",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.2.0"
+                        },
+                        {
+                            "version": "0.2.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.6.5"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.7.0",
+                                    "versionEndExcluding": "2.7.2"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "0.2.0"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "0.2.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openbao/openbao/security/advisories/GHSA-736f-82w7-hj22",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-736f-82w7-hj22)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openbao-before-2.6.5-and-2.7.2-acl-bypass-via-non-canonical-plugin-paths"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "gn00295120",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "datosh",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "omar152002",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "ria-labs-security",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "HAN-BAMBO",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "cipherboy",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126313.json b/data/2026/126xxx/CVE-2026-126313.json
new file mode 100644
index 0000000000..d47ea7718a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126313.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126313",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:16:44.443Z",
+        "datePublished": "2026-11-13T09:36:16.853Z",
+        "dateUpdated": "2026-11-13T09:36:16.853Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:16.853Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.20.1"
+                        },
+                        {
+                            "version": "16.20.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-rh2j-fcxx-r67m",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rh2j-fcxx-r67m)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-authorization-bypass-via-employee-records"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Darshan060224",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "deepeshgarg007",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126314.json b/data/2026/126xxx/CVE-2026-126314.json
new file mode 100644
index 0000000000..26f02ff447
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126314.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126314",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.991Z",
+        "datePublished": "2026-11-13T09:36:16.153Z",
+        "dateUpdated": "2026-11-13T09:36:16.153Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:16.153Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "15.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "15.64.6"
+                        },
+                        {
+                            "version": "15.64.6",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.20.1"
+                        },
+                        {
+                            "version": "16.20.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-m8m7-r43p-2jjf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-m8m7-r43p-2jjf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.6-missing-authorization-in-bulk-record-creation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Darshan060224",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "deepeshgarg007",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126315.json b/data/2026/126xxx/CVE-2026-126315.json
new file mode 100644
index 0000000000..c288e90f0c
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126315.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126315",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:15.474Z",
+        "dateUpdated": "2026-11-13T09:36:15.474Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:15.474Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Private Personal Information to an Unauthorized Actor",
+                            "cweId": "CWE-359",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.14.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.20.1"
+                        },
+                        {
+                            "version": "16.20.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 9.3,
+                        "baseSeverity": "CRITICAL",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 9.8,
+                        "baseSeverity": "CRITICAL",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-26gj-rr4j-3hgc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-26gj-rr4j-3hgc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-16.14.0-before-16.20.1-telemetry-setting-bypass-information-exposure"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Darshan060224",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "deepeshgarg007",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126316.json b/data/2026/126xxx/CVE-2026-126316.json
new file mode 100644
index 0000000000..5d5f631505
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126316.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126316",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:14.731Z",
+        "dateUpdated": "2026-11-13T09:36:14.731Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:14.731Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Use of GET Request Method With Sensitive Query Strings",
+                            "cweId": "CWE-598",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.20.1"
+                        },
+                        {
+                            "version": "16.20.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "attackVector": "NETWORK",
+                        "baseScore": 2.1,
+                        "baseSeverity": "LOW",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "HIGH",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "HIGH",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 2.2,
+                        "baseSeverity": "LOW",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-hphm-4mc5-m7gj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hphm-4mc5-m7gj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-subscription-key-exposure-via-request-url"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Darshan060224",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "deepeshgarg007",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126317.json b/data/2026/126xxx/CVE-2026-126317.json
new file mode 100644
index 0000000000..d58f77b84b
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126317.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126317",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:14.050Z",
+        "dateUpdated": "2026-11-13T09:36:14.050Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:14.050Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.20.1"
+                        },
+                        {
+                            "version": "16.20.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-v72r-rg45-x9rh",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-v72r-rg45-x9rh)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-missing-authorization-in-company-details-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Darshan060224",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "deepeshgarg007",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126318.json b/data/2026/126xxx/CVE-2026-126318.json
new file mode 100644
index 0000000000..c1e7c20540
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126318.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126318",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:13.376Z",
+        "dateUpdated": "2026-11-13T09:36:13.376Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:13.376Z"
+            },
+            "datePublic": "2026-10-25T00:00:00.000Z",
+            "title": "REDAXO before 5.21.6 Authorization Bypass of Live Version Permission",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "redaxo",
+                    "product": "core",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "5.21.6"
+                        },
+                        {
+                            "version": "5.21.6",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "5.21.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/redaxo/core/security/advisories/GHSA-6w5f-mr8f-5964",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6w5f-mr8f-5964)"
+                },
+                {
+                    "name": "VulnCheck Advisory: REDAXO before 5.21.6 Authorization Bypass of Live Version Permission",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/redaxo-before-5.21.6-authorization-bypass-of-live-version-permission"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "skerbis",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126319.json b/data/2026/126xxx/CVE-2026-126319.json
new file mode 100644
index 0000000000..00e1faebfd
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126319.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126319",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:12.691Z",
+        "dateUpdated": "2026-11-13T09:36:12.691Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:12.691Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Finsys",
+                    "product": "dockhand",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.0.55"
+                        },
+                        {
+                            "version": "1.0.55",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-q8p8-fhph-f9mj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-q8p8-fhph-f9mj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.55-arbitrary-file-read-via-stack-adoption-compose-path"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "FelipeDuartee",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126320.json b/data/2026/126xxx/CVE-2026-126320.json
new file mode 100644
index 0000000000..45353c4c22
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126320.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126320",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:12.031Z",
+        "dateUpdated": "2026-11-13T09:36:12.031Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:12.031Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Dockhand before 1.0.55 Improper Authorization via Container File Download Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary container files instead of requiring containers:exec. Authenticated Enterprise RBAC users can request any path from the files/download endpoint, which reads through Docker's archive API, to retrieve secrets, keys, and mounted credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Authorization",
+                            "cweId": "CWE-285",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Finsys",
+                    "product": "dockhand",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.0.55"
+                        },
+                        {
+                            "version": "1.0.55",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-r924-w2cm-9cjg",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-r924-w2cm-9cjg)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Dockhand before 1.0.55 Improper Authorization via Container File Download Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.55-improper-authorization-via-container-file-download-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "FelipeDuartee",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126321.json b/data/2026/126xxx/CVE-2026-126321.json
new file mode 100644
index 0000000000..c538c8c396
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126321.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126321",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:11.349Z",
+        "dateUpdated": "2026-11-13T09:36:11.349Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:11.349Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "Dockhand before 1.0.55 Path Traversal via Symlink in File-Browser Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser path guard by combining symlinks with '..' sequences. Attackers can read /proc/self/environ, the SQLite database, and the encryption key via /api/system/files/content, or move them using the stack relocate endpoint, exposing stored credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Finsys",
+                    "product": "dockhand",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.0.55"
+                        },
+                        {
+                            "version": "1.0.55",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-8vcv-cvj7-g5vx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8vcv-cvj7-g5vx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Dockhand before 1.0.55 Path Traversal via Symlink in File-Browser Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.55-path-traversal-via-symlink-in-file-browser-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "FelipeDuartee",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126322.json b/data/2026/126xxx/CVE-2026-126322.json
new file mode 100644
index 0000000000..c7eb8f6770
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126322.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126322",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:10.583Z",
+        "dateUpdated": "2026-11-13T09:36:10.583Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:10.583Z"
+            },
+            "datePublic": "2026-08-18T00:00:00.000Z",
+            "title": "OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Deserialization of Untrusted Data",
+                            "cweId": "CWE-502",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.3.0"
+                        },
+                        {
+                            "version": "8.3.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.3.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-r52j-mq9p-mh85",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-r52j-mq9p-mh85)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.3.0-unsanitized-deserialization-via-patient-match-dialog-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "nedlir",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "kojiromike",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126323.json b/data/2026/126xxx/CVE-2026-126323.json
new file mode 100644
index 0000000000..a1f348341a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126323.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126323",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T20:18:40.992Z",
+        "datePublished": "2026-11-13T09:36:09.910Z",
+        "dateUpdated": "2026-11-13T09:36:09.910Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:09.910Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Cross-Site Request Forgery (CSRF)",
+                            "cweId": "CWE-352",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "REQUIRED",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-grxp-rj92-j8xr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-grxp-rj92-j8xr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-csrf-via-get-admin-state-changing-actions"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "vq4s",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "fgetss",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126369.json b/data/2026/126xxx/CVE-2026-126369.json
new file mode 100644
index 0000000000..91431c3a1b
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126369.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126369",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.549Z",
+        "datePublished": "2026-11-13T09:36:09.242Z",
+        "dateUpdated": "2026-11-13T09:36:09.242Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:09.242Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript&colon; entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "CHANGED",
+                        "userInteraction": "REQUIRED",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-prqj-4768-vcmq",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-prqj-4768-vcmq)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-stored-xss-via-sanitizehtml-blacklist-bypass"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "vq4s",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "fgetss",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126370.json b/data/2026/126xxx/CVE-2026-126370.json
new file mode 100644
index 0000000000..e510b4bfec
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126370.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126370",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.549Z",
+        "datePublished": "2026-11-13T09:36:08.557Z",
+        "dateUpdated": "2026-11-13T09:36:08.557Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:08.557Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incomplete List of Disallowed Inputs",
+                            "cweId": "CWE-184",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-2mq4-4q7r-q52q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2mq4-4q7r-q52q)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-authenticated-rce-via-sql-code-injection-in-editor-code-save"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "vq4s",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "fgetss",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126371.json b/data/2026/126xxx/CVE-2026-126371.json
new file mode 100644
index 0000000000..e592266b6d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126371.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126371",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.549Z",
+        "datePublished": "2026-11-13T09:36:07.876Z",
+        "dateUpdated": "2026-11-13T09:36:07.876Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:07.876Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-ffrq-8926-cpc9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-ffrq-8926-cpc9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-admin-auth-tokensql-update-array-keys"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "TOzyTOl",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126372.json b/data/2026/126xxx/CVE-2026-126372.json
new file mode 100644
index 0000000000..9b4943197c
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126372.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126372",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.549Z",
+        "datePublished": "2026-11-13T09:36:07.223Z",
+        "dateUpdated": "2026-11-13T09:36:07.223Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:07.223Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Unrestricted Upload of File with Dangerous Type",
+                            "cweId": "CWE-434",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-7h6v-ww3f-24pp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-template-upload-bypass-via-mediatrait-editor-code"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126373.json b/data/2026/126xxx/CVE-2026-126373.json
new file mode 100644
index 0000000000..d54ced931e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126373.json
@@ -0,0 +1,147 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126373",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.549Z",
+        "datePublished": "2026-11-13T09:36:06.554Z",
+        "dateUpdated": "2026-11-13T09:36:06.554Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:06.554Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "1.0.8.4",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "1.0.8.4",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-7fg6-jfgq-56q9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-7fg6-jfgq-56q9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-1.0.8.4-through-1.0.8.6-authorization-bypass-via-post-revisions"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "avrlab233",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126374.json b/data/2026/126xxx/CVE-2026-126374.json
new file mode 100644
index 0000000000..2a05992f02
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126374.json
@@ -0,0 +1,132 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126374",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.549Z",
+        "datePublished": "2026-11-13T09:36:05.890Z",
+        "dateUpdated": "2026-11-13T09:36:05.890Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:05.890Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-fwp9-mpg4-hh5w",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fwp9-mpg4-hh5w)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-keys-each-array-keys"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126375.json b/data/2026/126xxx/CVE-2026-126375.json
new file mode 100644
index 0000000000..14e6ea5cf3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126375.json
@@ -0,0 +1,132 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126375",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.550Z",
+        "datePublished": "2026-11-13T09:36:05.220Z",
+        "dateUpdated": "2026-11-13T09:36:05.220Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:05.220Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-387r-2vfq-vrmf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-cross-tenant-digital-asset-tampering-via-media-trait"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126376.json b/data/2026/126xxx/CVE-2026-126376.json
new file mode 100644
index 0000000000..97614bd47a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126376.json
@@ -0,0 +1,133 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126376",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.550Z",
+        "datePublished": "2026-11-13T09:36:04.558Z",
+        "dateUpdated": "2026-11-13T09:36:04.558Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:04.558Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() on posts or products, or enumerate every vendor's digital-asset metadata."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "1.0.8.4",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "1.0.8.4",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-g7j8-g4xq-f232",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-g7j8-g4xq-f232)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-1.0.8.4-through-1.0.8.6-bola-via-posts-products-and-digital-assets"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126377.json b/data/2026/126xxx/CVE-2026-126377.json
new file mode 100644
index 0000000000..8165aa921d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126377.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126377",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.550Z",
+        "datePublished": "2026-11-13T09:36:03.862Z",
+        "dateUpdated": "2026-11-13T09:36:03.862Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:03.862Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Authentication",
+                            "cweId": "CWE-287",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "1.0.9.0"
+                        },
+                        {
+                            "version": "1.0.9.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.0.9.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-p8w8-2rq6-wm2g",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-p8w8-2rq6-wm2g)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-before-1.0.9.0-cookie-forgery-via-php-type-juggling-in-generatecookie"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "andy21190",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126378.json b/data/2026/126xxx/CVE-2026-126378.json
new file mode 100644
index 0000000000..d325edbc88
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126378.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126378",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:25:31.550Z",
+        "datePublished": "2026-11-13T09:36:03.184Z",
+        "dateUpdated": "2026-11-13T09:36:03.184Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:03.184Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Unrestricted Upload of File with Dangerous Type",
+                            "cweId": "CWE-434",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "1.0.8.6"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "1.0.8.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "HIGH",
+                        "baseScore": 9.4,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xpgr-r6c8-3hpq",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-xpgr-r6c8-3hpq)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-webshell-upload-via-theme-installer-validfile-bypass"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "de3erve-hunter",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126379.json b/data/2026/126xxx/CVE-2026-126379.json
new file mode 100644
index 0000000000..c3d274ef85
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126379.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126379",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:36:02.526Z",
+        "dateUpdated": "2026-11-13T09:36:02.526Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:02.526Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Server-Side Request Forgery (SSRF)",
+                            "cweId": "CWE-918",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "1.0.8.6",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "1.0.9.0"
+                        },
+                        {
+                            "version": "1.0.9.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "1.0.8.6",
+                                    "versionEndExcluding": "1.0.9.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-42hc-694f-hcqm)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-1.0.8.6-ssrf-via-oembed-proxy-dns-rebinding"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Kairos-T",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126380.json b/data/2026/126xxx/CVE-2026-126380.json
new file mode 100644
index 0000000000..f2c50d0f90
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126380.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126380",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:36:01.857Z",
+        "dateUpdated": "2026-11-13T09:36:01.857Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:01.857Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Unrestricted Upload of File with Dangerous Type",
+                            "cweId": "CWE-434",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "givanz",
+                    "product": "Vvveb",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:composer/vvveb/vvveb",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "1.0.9.0"
+                        },
+                        {
+                            "version": "1.0.9.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.0.9.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "HIGH",
+                        "baseScore": 9.4,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-hcpj-pcpx-2744",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hcpj-pcpx-2744)"
+                },
+                {
+                    "url": "https://github.com/givanz/Vvveb/commit/638a6c6f5a7a7f7ff4c65f996894f400d8fb8e77",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vvveb-before-1.0.9.0-rce-via-phar-extension-denylist-bypass-in-media-upload"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "JosanGeorge",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126381.json b/data/2026/126xxx/CVE-2026-126381.json
new file mode 100644
index 0000000000..43488bc197
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126381.json
@@ -0,0 +1,215 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126381",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:36:01.182Z",
+        "dateUpdated": "2026-11-13T09:36:01.182Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:01.182Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.44.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.44.1"
+                        },
+                        {
+                            "version": "2.44.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.43.5"
+                        },
+                        {
+                            "version": "2.43.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.44.0",
+                                    "versionEndExcluding": "2.44.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.43.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2x68-96jw-5r6c)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-2.44.1-sql-injection-via-vector-store-oracledb-metadata-filter-key"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "L1ngSh1",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126382.json b/data/2026/126xxx/CVE-2026-126382.json
new file mode 100644
index 0000000000..06c87a8718
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126382.json
@@ -0,0 +1,180 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126382",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:36:00.507Z",
+        "dateUpdated": "2026-11-13T09:36:00.507Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:00.507Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authentication for Critical Function",
+                            "cweId": "CWE-306",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.38.0"
+                        },
+                        {
+                            "version": "2.38.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.38.0"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mx4r-96jx-v278)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-2.38.0-authentication-bypass-via-asana-trigger-webhook-secret-reset"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Har1sh-k",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126383.json b/data/2026/126xxx/CVE-2026-126383.json
new file mode 100644
index 0000000000..42aadd17eb
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126383.json
@@ -0,0 +1,250 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126383",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:35:59.797Z",
+        "dateUpdated": "2026-11-13T09:35:59.797Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:59.797Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements in Data Query Logic",
+                            "cweId": "CWE-943",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.123.89"
+                        },
+                        {
+                            "version": "1.123.89",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.123.89"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.0.0",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "HIGH",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4v22-g448-h4rg)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.89-nosql-injection-via-mongodb-node-update-key"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Masofgon",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126384.json b/data/2026/126xxx/CVE-2026-126384.json
new file mode 100644
index 0000000000..af02d0b272
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126384.json
@@ -0,0 +1,255 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126384",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:35:59.112Z",
+        "dateUpdated": "2026-11-13T09:35:59.112Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:59.112Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Dependency on Vulnerable Third-Party Component",
+                            "cweId": "CWE-1395",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.123.89"
+                        },
+                        {
+                            "version": "1.123.89",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.123.89"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.0.0",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-f2cw-9483-7vcp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-bundled-graphicsmagick-in-edit-image-node"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "NumberOreo1",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "0xNasu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126385.json b/data/2026/126xxx/CVE-2026-126385.json
new file mode 100644
index 0000000000..69ac70bcc0
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126385.json
@@ -0,0 +1,215 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126385",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:35:58.422Z",
+        "dateUpdated": "2026-11-13T09:35:58.422Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:58.422Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authentication for Critical Function",
+                            "cweId": "CWE-306",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-426f-xmcv-g8pg)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-2.46.1-oauth-account-hijack-via-unauthenticated-credential-callback"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "sm1ee",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126386.json b/data/2026/126xxx/CVE-2026-126386.json
new file mode 100644
index 0000000000..9cf26ca2f5
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126386.json
@@ -0,0 +1,250 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126386",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:35:57.737Z",
+        "dateUpdated": "2026-11-13T09:35:57.737Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:57.737Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerability in the unauthenticated MCP OAuth dynamic client registration flow, which accepts arbitrary redirect_uri values via the /mcp-oauth/register endpoint. Attackers can send victims crafted /mcp-oauth/authorize URLs that redirect them to attacker-controlled sites before instance checks run, enabling phishing."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "URL Redirection to Untrusted Site ('Open Redirect')",
+                            "cweId": "CWE-601",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.123.89"
+                        },
+                        {
+                            "version": "1.123.89",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.123.89"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.0.0",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "ACTIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.7,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rc3w-8jc8-7x3w)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.89-open-redirect-via-mcp-oauth-dynamic-client-registration"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "athul-DarkRange",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126387.json b/data/2026/126xxx/CVE-2026-126387.json
new file mode 100644
index 0000000000..6fee29f437
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126387.json
@@ -0,0 +1,215 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126387",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.841Z",
+        "datePublished": "2026-11-13T09:35:57.075Z",
+        "dateUpdated": "2026-11-13T09:35:57.075Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:57.075Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Absolute Path Traversal",
+                            "cweId": "CWE-36",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9qx8-fhxv-w794",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9qx8-fhxv-w794)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-2.46.1-arbitrary-file-read-via-browser-use-browser-upload-tool"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "sm1ee",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126388.json b/data/2026/126xxx/CVE-2026-126388.json
new file mode 100644
index 0000000000..d625e6408d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126388.json
@@ -0,0 +1,215 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126388",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:26:25.842Z",
+        "datePublished": "2026-11-13T09:35:56.306Z",
+        "dateUpdated": "2026-11-13T09:35:56.306Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:56.306Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 2.46.1 contains a credential exposure vulnerability that forwards Authorization headers and basic auth credentials on cross-origin redirects because sendCredentialsOnCrossOriginRedirect defaults to true. Attackers controlling a redirect target or an expression-fed URL in credential-using nodes can capture stored workflow credentials sent to their endpoint."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficiently Protected Credentials",
+                            "cweId": "CWE-522",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-prmc-fg87-r4gh)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-2.46.1-credential-leak-via-cross-origin-redirects-in-nodes"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "klydz",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126389.json b/data/2026/126xxx/CVE-2026-126389.json
new file mode 100644
index 0000000000..adea02ac9c
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126389.json
@@ -0,0 +1,250 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126389",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:55.673Z",
+        "dateUpdated": "2026-11-13T09:35:55.673Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:55.673Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authentication Bypass Using an Alternate Path or Channel",
+                            "cweId": "CWE-288",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.123.89"
+                        },
+                        {
+                            "version": "1.123.89",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.123.89"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.0.0",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-pwj5-wwm6-g83j)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.89-authentication-bypass-via-chat-trigger-embedded-chat"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Masofgon",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126390.json b/data/2026/126xxx/CVE-2026-126390.json
new file mode 100644
index 0000000000..ead02d1489
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126390.json
@@ -0,0 +1,250 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126390",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:55.075Z",
+        "dateUpdated": "2026-11-13T09:35:55.075Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:55.075Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API token to attacker-chosen hosts when downloading attachments. Attackers with write access to a NocoDB attachment cell can insert a URL to their host, capturing the API token when the workflow executes with Download Attachments enabled."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficiently Protected Credentials",
+                            "cweId": "CWE-522",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.123.89"
+                        },
+                        {
+                            "version": "1.123.89",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.123.89"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.0.0",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jmcg-c7p5-q69g",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-jmcg-c7p5-q69g)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.89-nocodb-node-api-token-leak-via-attachment-download"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "tr4ce-ju",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126391.json b/data/2026/126xxx/CVE-2026-126391.json
new file mode 100644
index 0000000000..c90d8e19f0
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126391.json
@@ -0,0 +1,255 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126391",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:54.388Z",
+        "dateUpdated": "2026-11-13T09:35:54.388Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:54.388Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Control of Generation of Code ('Code Injection')",
+                            "cweId": "CWE-94",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.123.89"
+                        },
+                        {
+                            "version": "1.123.89",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.46.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.46.1"
+                        },
+                        {
+                            "version": "2.46.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "2.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.45.5"
+                        },
+                        {
+                            "version": "2.45.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "n8n-io",
+                    "product": "n8n",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/n8n",
+                    "versions": [
+                        {
+                            "version": "3.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.0.1"
+                        },
+                        {
+                            "version": "3.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.123.89"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.46.0",
+                                    "versionEndExcluding": "2.46.1"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.0.0",
+                                    "versionEndExcluding": "2.45.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "3.0.0",
+                                    "versionEndExcluding": "3.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-gx3v-3x3v-f8r5)"
+                },
+                {
+                    "name": "VulnCheck Advisory: n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-workflow-expression-evaluation-sandbox-escape"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "NumberOreo1",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "0xNasu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126392.json b/data/2026/126xxx/CVE-2026-126392.json
new file mode 100644
index 0000000000..1453fd7f01
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126392.json
@@ -0,0 +1,171 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126392",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:53.670Z",
+        "dateUpdated": "2026-11-13T09:35:53.670Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:53.670Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Observable Discrepancy",
+                            "cweId": "CWE-203",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "parse-community",
+                    "product": "parse-server",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/parse-server",
+                    "versions": [
+                        {
+                            "version": "9.10.6-alpha.1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "9.10.8-alpha.1"
+                        },
+                        {
+                            "version": "9.10.8-alpha.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "parse-community",
+                    "product": "parse-server",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/parse-server",
+                    "versions": [
+                        {
+                            "version": "8.6.109",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.6.118"
+                        },
+                        {
+                            "version": "8.6.118",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "9.10.6-alpha.1",
+                                    "versionEndExcluding": "9.10.8-alpha.1"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "8.6.109",
+                                    "versionEndExcluding": "8.6.118"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.1,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-4m87-fqwv-2m8v",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4m87-fqwv-2m8v)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.8-alpha.1-information-disclosure-via-dot-notation-update"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "mtrezza",
+                    "type": "coordinator"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126393.json b/data/2026/126xxx/CVE-2026-126393.json
new file mode 100644
index 0000000000..48362549ab
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126393.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126393",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:52.971Z",
+        "dateUpdated": "2026-11-13T09:35:52.971Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:52.971Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "SiYuan before 3.8.10 SSRF via Skill-Install Download Redirect and DNS Rebinding",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebinds to loopback addresses, reaching internal services and metadata endpoints."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Server-Side Request Forgery (SSRF)",
+                            "cweId": "CWE-918",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "siyuan-note",
+                    "product": "siyuan",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "3.8.10"
+                        },
+                        {
+                            "version": "3.8.10",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.8.10"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6pg3-pqxw-jm82",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6pg3-pqxw-jm82)"
+                },
+                {
+                    "name": "VulnCheck Advisory: SiYuan before 3.8.10 SSRF via Skill-Install Download Redirect and DNS Rebinding",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.10-ssrf-via-skill-install-download-redirect-and-dns-rebinding"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Figo5",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126394.json b/data/2026/126xxx/CVE-2026-126394.json
new file mode 100644
index 0000000000..93c078a08b
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126394.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126394",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:52.305Z",
+        "dateUpdated": "2026-11-13T09:35:52.305Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:52.305Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu video_backend with a huge num_frames, forcing np.linspace allocations and CPU work that OOM-kill the API server."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "vllm-project",
+                    "product": "vllm",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/vllm",
+                    "versions": [
+                        {
+                            "version": "0.30.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.31.0"
+                        },
+                        {
+                            "version": "0.31.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.30.0",
+                                    "versionEndExcluding": "0.31.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-894j-wg8m-63h8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-894j-wg8m-63h8)"
+                },
+                {
+                    "name": "VulnCheck Advisory: vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vllm-0.30.0-before-0.31.0-resource-exhaustion-via-openpangu-video-backend-num-frames"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "gn00295120",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "jperezdealgaba",
+                    "type": "coordinator"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126395.json b/data/2026/126xxx/CVE-2026-126395.json
new file mode 100644
index 0000000000..03eef36eac
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126395.json
@@ -0,0 +1,156 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126395",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:51.636Z",
+        "dateUpdated": "2026-11-13T09:35:51.636Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:51.636Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insertion of Sensitive Information into Log File",
+                            "cweId": "CWE-532",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "vllm-project",
+                    "product": "vllm",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/vllm",
+                    "versions": [
+                        {
+                            "version": "0.14.0rc1",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThan": "0.31.0"
+                        },
+                        {
+                            "version": "0.31.0",
+                            "status": "unaffected",
+                            "versionType": "custom"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.14.0rc1",
+                                    "versionEndExcluding": "0.31.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-m9fg-w9qh-67pc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-m9fg-w9qh-67pc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vllm-0.14-0rc1-before-0.31.0-heap-address-disclosure-via-sanitize-message"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "0xiviel",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "jperezdealgaba",
+                    "type": "coordinator"
+                },
+                {
+                    "lang": "en",
+                    "value": "DarkLight1337",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126396.json b/data/2026/126xxx/CVE-2026-126396.json
new file mode 100644
index 0000000000..ea96865c9f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126396.json
@@ -0,0 +1,169 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126396",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:50.950Z",
+        "dateUpdated": "2026-11-13T09:46:05.921Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:46:05.921Z"
+            },
+            "title": "vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service."
+                }
+            ],
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "vllm-project",
+                    "product": "vllm",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/vllm",
+                    "versions": [
+                        {
+                            "version": "0.24.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.31.0"
+                        },
+                        {
+                            "version": "0.31.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.24.0",
+                                    "versionEndExcluding": "0.31.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV4_0": {
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "valueDensity": "NOT_DEFINED",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED",
+                        "providerUrgency": "NOT_DEFINED",
+                        "version": "4.0",
+                        "baseSeverity": "MEDIUM",
+                        "baseScore": 6.9,
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV3_1": {
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "version": "3.1",
+                        "baseSeverity": "MEDIUM",
+                        "baseScore": 5.3,
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-w4cg-mhc7-mgw3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-w4cg-mhc7-mgw3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vllm-from-0.24.0-before-0.31.0-resource-exhaustion-via-minimax-m3-min-pixels"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "mg-princess",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "jperezdealgaba",
+                    "type": "coordinator"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-one-hundred-kay"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126397.json b/data/2026/126xxx/CVE-2026-126397.json
new file mode 100644
index 0000000000..09458c648a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126397.json
@@ -0,0 +1,165 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126397",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:50.274Z",
+        "dateUpdated": "2026-11-13T09:35:50.274Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:50.274Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "vLLM 0.10.1 before 0.31.0 Cohere2 Vision DoS via max_patches",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. Remote clients can send small image chat-completion requests with large, varying max_patches values to bypass the LRU cache, exhaust preprocessing workers, and deny service to other clients."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Resource Consumption",
+                            "cweId": "CWE-400",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "vllm-project",
+                    "product": "vllm",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/vllm",
+                    "versions": [
+                        {
+                            "version": "0.10.1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.31.0"
+                        },
+                        {
+                            "version": "0.31.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.10.1",
+                                    "versionEndExcluding": "0.31.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-9g3c-x747-c6wr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9g3c-x747-c6wr)"
+                },
+                {
+                    "url": "https://github.com/vllm-project/vllm/commit/f6326f53bda46898a331c2d24500332c285d9a2b",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: vLLM 0.10.1 before 0.31.0 Cohere2 Vision DoS via max_patches",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vllm-0.10.1-before-0.31.0-cohere2-vision-dos-via-max-patches"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "0xbbdd",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "jperezdealgaba",
+                    "type": "coordinator"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126398.json b/data/2026/126xxx/CVE-2026-126398.json
new file mode 100644
index 0000000000..9b7708b72d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126398.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126398",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:30:16.910Z",
+        "datePublished": "2026-11-13T09:35:49.601Z",
+        "dateUpdated": "2026-11-13T09:35:49.601Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:49.601Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only prompt_embeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Reachable Assertion",
+                            "cweId": "CWE-617",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "vllm-project",
+                    "product": "vllm",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/vllm",
+                    "versions": [
+                        {
+                            "version": "0.28.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.30.0"
+                        },
+                        {
+                            "version": "0.30.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.28.0",
+                                    "versionEndExcluding": "0.30.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-5q78-j82c-2vr2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-5q78-j82c-2vr2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vllm-0.28.0-before-0.30.0-denial-of-service-via-prompt-embeds-on-xd-rope-models"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "wildoranges",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "jperezdealgaba",
+                    "type": "coordinator"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126399.json b/data/2026/126xxx/CVE-2026-126399.json
new file mode 100644
index 0000000000..8ed45d601a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126399.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126399",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.764Z",
+        "datePublished": "2026-11-13T09:35:48.994Z",
+        "dateUpdated": "2026-11-13T09:35:48.994Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:48.994Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large value with many base64 JPEG frames, forcing VideoMediaIO to decode all frames and np.stack them, causing memory exhaustion."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "vllm-project",
+                    "product": "vllm",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/vllm",
+                    "versions": [
+                        {
+                            "version": "0.19.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.31.0"
+                        },
+                        {
+                            "version": "0.31.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.19.0",
+                                    "versionEndExcluding": "0.31.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-vxqj-p4gw-9h4c",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-vxqj-p4gw-9h4c)"
+                },
+                {
+                    "name": "VulnCheck Advisory: vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/vllm-0.19.0-before-0.31.0-resource-exhaustion-via-request-level-num-frames"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "m4rgh",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "jperezdealgaba",
+                    "type": "coordinator"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126400.json b/data/2026/126xxx/CVE-2026-126400.json
new file mode 100644
index 0000000000..e68c6ef553
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126400.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126400",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.764Z",
+        "datePublished": "2026-11-13T09:35:48.368Z",
+        "dateUpdated": "2026-11-13T09:35:48.368Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:48.368Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Password Pusher 1.49.0 before 2.17.0 IP Spoofing via Unanchored Trusted-Proxy Regex",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify audit log entries and shift password generator rate limits."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Use of Less Trusted Source",
+                            "cweId": "CWE-348",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "pglombardo",
+                    "product": "PasswordPusher",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "1.49.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.17.0"
+                        },
+                        {
+                            "version": "2.17.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-p2xh-x263-68qc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-p2xh-x263-68qc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Password Pusher 1.49.0 before 2.17.0 IP Spoofing via Unanchored Trusted-Proxy Regex",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/password-pusher-1.49.0-before-2.17.0-ip-spoofing-via-unanchored-trusted-proxy-regex"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "rennf93",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126401.json b/data/2026/126xxx/CVE-2026-126401.json
new file mode 100644
index 0000000000..058275ab3f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126401.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126401",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:47.679Z",
+        "dateUpdated": "2026-11-13T09:35:47.679Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:47.679Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "Fleet before 4.86.2 Unauthenticated DoS via SSO Callback XML Canonicalization",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Inefficient Algorithmic Complexity",
+                            "cweId": "CWE-407",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "fleetdm",
+                    "product": "fleet",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/fleetdm/fleet",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.86.2"
+                        },
+                        {
+                            "version": "4.86.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "4.86.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-mjrh-3v6h-8g5p",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mjrh-3v6h-8g5p)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Fleet before 4.86.2 Unauthenticated DoS via SSO Callback XML Canonicalization",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/fleet-before-4.86.2-unauthenticated-dos-via-sso-callback-xml-canonicalization"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "fuzzztf",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126402.json b/data/2026/126xxx/CVE-2026-126402.json
new file mode 100644
index 0000000000..7f0a06e037
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126402.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126402",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:47.001Z",
+        "dateUpdated": "2026-11-13T09:35:47.001Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:47.001Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "Fleet before 4.89.0 Broken Access Control via User Administration API",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "fleetdm",
+                    "product": "fleet",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/fleetdm/fleet",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.89.0"
+                        },
+                        {
+                            "version": "4.89.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "4.89.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "HIGH",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-mj9p-fq5h-mw8h",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mj9p-fq5h-mw8h)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Fleet before 4.89.0 Broken Access Control via User Administration API",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/fleet-before-4.89.0-broken-access-control-via-user-administration-api"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126403.json b/data/2026/126xxx/CVE-2026-126403.json
new file mode 100644
index 0000000000..9e52fd7fab
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126403.json
@@ -0,0 +1,321 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126403",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:46.335Z",
+        "dateUpdated": "2026-11-13T09:35:46.335Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:46.335Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.38.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.38.4"
+                        },
+                        {
+                            "version": "2.38.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.37.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.37.8"
+                        },
+                        {
+                            "version": "2.37.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.36.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.11"
+                        },
+                        {
+                            "version": "2.36.11",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.30.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.34.16"
+                        },
+                        {
+                            "version": "2.34.16",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.26.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.29.24"
+                        },
+                        {
+                            "version": "2.29.24",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.35.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.0"
+                        },
+                        {
+                            "version": "2.36.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.38.0",
+                                    "versionEndExcluding": "2.38.4"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.37.0",
+                                    "versionEndExcluding": "2.37.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.36.0",
+                                    "versionEndExcluding": "2.36.11"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.30.0",
+                                    "versionEndExcluding": "2.34.16"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.26.0",
+                                    "versionEndExcluding": "2.29.24"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.35.0",
+                                    "versionEndExcluding": "2.36.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.5,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/coder/coder/security/advisories/GHSA-9frj-7f83-x984",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9frj-7f83-x984)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.4-authorization-bypass-via-external-agent-credentials-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Habib0x0",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126404.json b/data/2026/126xxx/CVE-2026-126404.json
new file mode 100644
index 0000000000..2da22d6038
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126404.json
@@ -0,0 +1,326 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126404",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:45.631Z",
+        "dateUpdated": "2026-11-13T09:35:45.631Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:45.631Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Privilege Assignment",
+                            "cweId": "CWE-266",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.38.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.38.4"
+                        },
+                        {
+                            "version": "2.38.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.37.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.37.8"
+                        },
+                        {
+                            "version": "2.37.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.36.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.11"
+                        },
+                        {
+                            "version": "2.36.11",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.30.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.34.16"
+                        },
+                        {
+                            "version": "2.34.16",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.28.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.29.24"
+                        },
+                        {
+                            "version": "2.29.24",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.35.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.0"
+                        },
+                        {
+                            "version": "2.36.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.38.0",
+                                    "versionEndExcluding": "2.38.4"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.37.0",
+                                    "versionEndExcluding": "2.37.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.36.0",
+                                    "versionEndExcluding": "2.36.11"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.30.0",
+                                    "versionEndExcluding": "2.34.16"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.28.0",
+                                    "versionEndExcluding": "2.29.24"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.35.0",
+                                    "versionEndExcluding": "2.36.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-x3gf-xv6p-56hf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "MutedCybersecurity",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "EhabY",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126405.json b/data/2026/126xxx/CVE-2026-126405.json
new file mode 100644
index 0000000000..5abea73089
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126405.json
@@ -0,0 +1,321 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126405",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:44.966Z",
+        "dateUpdated": "2026-11-13T09:35:44.966Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:44.966Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Resource Consumption",
+                            "cweId": "CWE-400",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.38.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.38.4"
+                        },
+                        {
+                            "version": "2.38.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.37.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.37.8"
+                        },
+                        {
+                            "version": "2.37.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.36.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.11"
+                        },
+                        {
+                            "version": "2.36.11",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.30.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.34.16"
+                        },
+                        {
+                            "version": "2.34.16",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.21.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.29.24"
+                        },
+                        {
+                            "version": "2.29.24",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "coder",
+                    "product": "coder",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/coder/coder/v2",
+                    "versions": [
+                        {
+                            "version": "2.35.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.36.0"
+                        },
+                        {
+                            "version": "2.36.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.38.0",
+                                    "versionEndExcluding": "2.38.4"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.37.0",
+                                    "versionEndExcluding": "2.37.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.36.0",
+                                    "versionEndExcluding": "2.36.11"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.30.0",
+                                    "versionEndExcluding": "2.34.16"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.21.0",
+                                    "versionEndExcluding": "2.29.24"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "2.35.0",
+                                    "versionEndExcluding": "2.36.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/coder/coder/security/advisories/GHSA-64xh-rgcx-gg65",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-64xh-rgcx-gg65)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-memory-exhaustion-dos-via-web-push"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "BobbyHo",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126406.json b/data/2026/126xxx/CVE-2026-126406.json
new file mode 100644
index 0000000000..0c4c4a0efd
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126406.json
@@ -0,0 +1,243 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126406",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:44.314Z",
+        "dateUpdated": "2026-11-13T09:35:44.314Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:44.314Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Wasmtime before 36.0.20 HTTP Request Smuggling via wasi-http p2 Content-Length",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 can send conflicting content-length headers, or ones not matching the body, in outgoing requests. A guest that reuses a received response's headers resource to send a bodyless request can enable request smuggling against non-compliant servers, potentially bypassing embedder destination access controls."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
+                            "cweId": "CWE-444",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime-wasi-http",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "36.0.20"
+                        },
+                        {
+                            "version": "36.0.20",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime-wasi-http",
+                    "versions": [
+                        {
+                            "version": "37.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "48.0.8"
+                        },
+                        {
+                            "version": "48.0.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime-wasi-http",
+                    "versions": [
+                        {
+                            "version": "49.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "49.0.5"
+                        },
+                        {
+                            "version": "49.0.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime-wasi-http",
+                    "versions": [
+                        {
+                            "version": "50.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "50.0.1"
+                        },
+                        {
+                            "version": "50.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "36.0.20"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "37.0.0",
+                                    "versionEndExcluding": "48.0.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "49.0.0",
+                                    "versionEndExcluding": "49.0.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "50.0.0",
+                                    "versionEndExcluding": "50.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h4wp-g4x3-7398",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-h4wp-g4x3-7398)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Wasmtime before 36.0.20 HTTP Request Smuggling via wasi-http p2 Content-Length",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/wasmtime-before-36.0.20-http-request-smuggling-via-wasi-http-p2-content-length"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126407.json b/data/2026/126xxx/CVE-2026-126407.json
new file mode 100644
index 0000000000..1bbe0a023e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126407.json
@@ -0,0 +1,243 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126407",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:43.638Z",
+        "dateUpdated": "2026-11-13T09:35:43.638Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:43.638Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "36.0.20"
+                        },
+                        {
+                            "version": "36.0.20",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "37.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "48.0.8"
+                        },
+                        {
+                            "version": "48.0.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "49.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "49.0.5"
+                        },
+                        {
+                            "version": "49.0.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "50.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "50.0.1"
+                        },
+                        {
+                            "version": "50.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "36.0.20"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "37.0.0",
+                                    "versionEndExcluding": "48.0.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "49.0.0",
+                                    "versionEndExcluding": "49.0.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "50.0.0",
+                                    "versionEndExcluding": "50.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6fr9-xmw9-5352",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6fr9-xmw9-5352)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/wasmtime-before-36.0.20-denial-of-service-via-borrowed-resource-transfer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126408.json b/data/2026/126xxx/CVE-2026-126408.json
new file mode 100644
index 0000000000..36430adb0a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126408.json
@@ -0,0 +1,209 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126408",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:32:21.765Z",
+        "datePublished": "2026-11-13T09:35:42.943Z",
+        "dateUpdated": "2026-11-13T09:35:42.943Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:42.943Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Wasmtime 47.0.0 before 48.0.8 Denial of Service via TypedFunc Type-Check Panic",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in the TypedFunc embedder API for I31, Option<I31>, and Option<NoneRef> parameter or result types, reaching an unreachable!() path. A malicious guest module exporting a function that uses another anyref-hierarchy type can panic the host embedding, causing denial of service."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Reachable Assertion",
+                            "cweId": "CWE-617",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "47.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "48.0.8"
+                        },
+                        {
+                            "version": "48.0.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "49.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "49.0.5"
+                        },
+                        {
+                            "version": "49.0.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "50.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "50.0.1"
+                        },
+                        {
+                            "version": "50.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "47.0.0",
+                                    "versionEndExcluding": "48.0.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "49.0.0",
+                                    "versionEndExcluding": "49.0.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "50.0.0",
+                                    "versionEndExcluding": "50.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "ADJACENT",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 1,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L",
+                        "attackVector": "ADJACENT_NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 1.8,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3982-jqvv-277m)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Wasmtime 47.0.0 before 48.0.8 Denial of Service via TypedFunc Type-Check Panic",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.8-denial-of-service-via-typedfunc-type-check-panic"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126409.json b/data/2026/126xxx/CVE-2026-126409.json
new file mode 100644
index 0000000000..5c2e43ffcd
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126409.json
@@ -0,0 +1,209 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126409",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.396Z",
+        "datePublished": "2026-11-13T09:35:42.234Z",
+        "dateUpdated": "2026-11-13T09:35:42.234Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:42.234Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Wasmtime 47.0.0 before 48.0.8 Cross-Engine Type Confusion via StructType Supertype",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vulnerability because StructType::with_finality_and_supertype does not validate that the supplied supertype belongs to the same Engine. Embedders using multiple engines that create a GC struct type with another engine's supertype can trigger runtime panics or GC heap corruption, causing denial of service; guest WebAssembly cannot trigger it."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Access of Resource Using Incompatible Type ('Type Confusion')",
+                            "cweId": "CWE-843",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "47.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "48.0.8"
+                        },
+                        {
+                            "version": "48.0.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "49.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "49.0.5"
+                        },
+                        {
+                            "version": "49.0.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime",
+                    "versions": [
+                        {
+                            "version": "50.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "50.0.1"
+                        },
+                        {
+                            "version": "50.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "47.0.0",
+                                    "versionEndExcluding": "48.0.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "49.0.0",
+                                    "versionEndExcluding": "49.0.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "50.0.0",
+                                    "versionEndExcluding": "50.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "ACTIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 1.8,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 2,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qw58-7h65-crq2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qw58-7h65-crq2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Wasmtime 47.0.0 before 48.0.8 Cross-Engine Type Confusion via StructType Supertype",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.8-cross-engine-type-confusion-via-structtype-supertype"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126410.json b/data/2026/126xxx/CVE-2026-126410.json
new file mode 100644
index 0000000000..6021d628f1
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126410.json
@@ -0,0 +1,221 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126410",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.396Z",
+        "datePublished": "2026-11-13T09:35:41.472Z",
+        "dateUpdated": "2026-11-13T09:35:41.472Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:41.472Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Wasmtime 48.0.0 before 48.0.8 TOCTOU UDP Send Policy Bypass via wasip3 Sockets",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a time-of-check/time-of-use race in the wasip3 wasi:sockets udp-socket host implementation that lets guests bypass socket_addr_check send restrictions. A malicious guest can race udp-socket.send against udp-socket.connect to deliver attacker-controlled datagrams to addresses the policy permits only for receiving."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
+                            "cweId": "CWE-367",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime-wasi",
+                    "versions": [
+                        {
+                            "version": "48.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "48.0.8"
+                        },
+                        {
+                            "version": "48.0.8",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime-wasi",
+                    "versions": [
+                        {
+                            "version": "49.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "49.0.5"
+                        },
+                        {
+                            "version": "49.0.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "bytecodealliance",
+                    "product": "wasmtime",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:cargo/wasmtime-wasi",
+                    "versions": [
+                        {
+                            "version": "50.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "50.0.1"
+                        },
+                        {
+                            "version": "50.0.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "48.0.0",
+                                    "versionEndExcluding": "48.0.8"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "49.0.0",
+                                    "versionEndExcluding": "49.0.5"
+                                }
+                            ]
+                        }
+                    ]
+                },
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "50.0.0",
+                                    "versionEndExcluding": "50.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmmr-87qq-258j",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hmmr-87qq-258j)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Wasmtime 48.0.0 before 48.0.8 TOCTOU UDP Send Policy Bypass via wasip3 Sockets",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/wasmtime-48.0.0-before-48.0.8-toctou-udp-send-policy-bypass-via-wasip3-sockets"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "las7",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "rvolosatovs",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126411.json b/data/2026/126xxx/CVE-2026-126411.json
new file mode 100644
index 0000000000..9d67b5977c
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126411.json
@@ -0,0 +1,139 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126411",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.396Z",
+        "datePublished": "2026-11-13T09:35:40.765Z",
+        "dateUpdated": "2026-11-13T09:35:40.765Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:40.765Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.50.0"
+                        },
+                        {
+                            "version": "16.50.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-x3q4-g9rf-5c7r",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-x3q4-g9rf-5c7r)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.50.0-missing-authorization-in-hr-workflow-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "iamkhanraheel",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "sakilahamed",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126412.json b/data/2026/126xxx/CVE-2026-126412.json
new file mode 100644
index 0000000000..8b56e485a3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126412.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126412",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.396Z",
+        "datePublished": "2026-11-13T09:35:39.219Z",
+        "dateUpdated": "2026-11-13T09:35:39.219Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:39.219Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "15.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "15.64.1"
+                        },
+                        {
+                            "version": "15.64.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.19.0"
+                        },
+                        {
+                            "version": "16.19.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-5643-8fxc-qpm2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-5643-8fxc-qpm2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-in-bulk-record-action"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "iamkhanraheel",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "T3l3sc0p3",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126413.json b/data/2026/126xxx/CVE-2026-126413.json
new file mode 100644
index 0000000000..906ea4ca88
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126413.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126413",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.396Z",
+        "datePublished": "2026-11-13T09:35:38.506Z",
+        "dateUpdated": "2026-11-13T09:35:38.506Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:38.506Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "15.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "15.64.1"
+                        },
+                        {
+                            "version": "15.64.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.19.0"
+                        },
+                        {
+                            "version": "16.19.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-p8rg-rfhr-fcx2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-p8rg-rfhr-fcx2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-on-file-details-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "iamkhanraheel",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "T3l3sc0p3",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126414.json b/data/2026/126xxx/CVE-2026-126414.json
new file mode 100644
index 0000000000..4f56eb6929
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126414.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126414",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.396Z",
+        "datePublished": "2026-11-13T09:35:37.838Z",
+        "dateUpdated": "2026-11-13T09:35:37.838Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:37.838Z"
+            },
+            "datePublic": "2026-10-29T00:00:00.000Z",
+            "title": "Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "15.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "15.64.2"
+                        },
+                        {
+                            "version": "15.64.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "frappe",
+                    "product": "hrms",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "16.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "16.20.0"
+                        },
+                        {
+                            "version": "16.20.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/frappe/hrms/security/advisories/GHSA-87rf-mqrq-hmm3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-87rf-mqrq-hmm3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.2-missing-authorization-in-record-update-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "iamkhanraheel",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "hackchang",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126415.json b/data/2026/126xxx/CVE-2026-126415.json
new file mode 100644
index 0000000000..8f930de8b3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126415.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126415",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.396Z",
+        "datePublished": "2026-11-13T09:35:37.169Z",
+        "dateUpdated": "2026-11-13T09:35:37.169Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:37.169Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-q4jf-6gcg-m3jx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-q4jf-6gcg-m3jx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-patientvalidation-module"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "TemppVariable",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126416.json b/data/2026/126xxx/CVE-2026-126416.json
new file mode 100644
index 0000000000..403aea14ab
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126416.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126416",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.397Z",
+        "datePublished": "2026-11-13T09:35:36.479Z",
+        "dateUpdated": "2026-11-13T09:35:36.479Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:36.479Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Authorization",
+                            "cweId": "CWE-285",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-cxjf-fmpw-qc34",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-cxjf-fmpw-qc34)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-patient-tracker-status-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Leousum",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126417.json b/data/2026/126xxx/CVE-2026-126417.json
new file mode 100644
index 0000000000..c46083e99e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126417.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126417",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.397Z",
+        "datePublished": "2026-11-13T09:35:35.804Z",
+        "dateUpdated": "2026-11-13T09:35:35.804Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:35.804Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Access Control",
+                            "cweId": "CWE-284",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-9rw5-h7xf-57mc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9rw5-h7xf-57mc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-information-disclosure-via-get-claim-file-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126418.json b/data/2026/126xxx/CVE-2026-126418.json
new file mode 100644
index 0000000000..38a3302aa7
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126418.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126418",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:34:05.397Z",
+        "datePublished": "2026-11-13T09:35:35.126Z",
+        "dateUpdated": "2026-11-13T09:35:35.126Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:35.126Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-v7qh-q4xq-28v3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-v7qh-q4xq-28v3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-in-sl-eob-invoice-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126419.json b/data/2026/126xxx/CVE-2026-126419.json
new file mode 100644
index 0000000000..7b848f2cfb
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126419.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126419",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:34.434Z",
+        "dateUpdated": "2026-11-13T09:35:34.434Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:34.434Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6x2w-9gwv-mc7v",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6x2w-9gwv-mc7v)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-e-sign-form-submission"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126420.json b/data/2026/126xxx/CVE-2026-126420.json
new file mode 100644
index 0000000000..8623162d67
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126420.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126420",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:33.766Z",
+        "dateUpdated": "2026-11-13T09:35:33.766Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:33.766Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-ppg9-2f9f-chc4",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-ppg9-2f9f-chc4)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-faxsms-utility-php-patient-creation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126421.json b/data/2026/126xxx/CVE-2026-126421.json
new file mode 100644
index 0000000000..0a0616f28d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126421.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126421",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:33.115Z",
+        "dateUpdated": "2026-11-13T09:35:33.115Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:33.115Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-3j3r-w7q7-h9fj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3j3r-w7q7-h9fj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-labs-ajax-php-label-count"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126422.json b/data/2026/126xxx/CVE-2026-126422.json
new file mode 100644
index 0000000000..a5ed8e4537
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126422.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126422",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:32.468Z",
+        "dateUpdated": "2026-11-13T09:35:32.468Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:32.468Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via lists_touch.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record \"None known\" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-924r-c6jp-67px",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-924r-c6jp-67px)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via lists_touch.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-lists-touch-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126423.json b/data/2026/126xxx/CVE-2026-126423.json
new file mode 100644
index 0000000000..b68aedde1d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126423.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126423",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:31.761Z",
+        "dateUpdated": "2026-11-13T09:35:31.761Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:31.761Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Handling of Highly Compressed Data (Data Amplification)",
+                            "cweId": "CWE-409",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-pqmf-m4h6-wjh4",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-pqmf-m4h6-wjh4)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-zip-upload-decompression"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126424.json b/data/2026/126xxx/CVE-2026-126424.json
new file mode 100644
index 0000000000..a7d8c226d4
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126424.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126424",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:31.004Z",
+        "dateUpdated": "2026-11-13T09:35:31.004Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:31.004Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "ACTIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.5,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-qv97-cvw6-8j53",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qv97-cvw6-8j53)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-descriptions"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126425.json b/data/2026/126xxx/CVE-2026-126425.json
new file mode 100644
index 0000000000..1d2451f4b3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126425.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126425",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:30.379Z",
+        "dateUpdated": "2026-11-13T09:35:30.379Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:30.379Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-fq58-jp5g-x44q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fq58-jp5g-x44q)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-sql-injection-via-history-layout-field-identifiers"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126426.json b/data/2026/126xxx/CVE-2026-126426.json
new file mode 100644
index 0000000000..ea28d3d587
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126426.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126426",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:29.713Z",
+        "dateUpdated": "2026-11-13T09:35:29.713Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:29.713Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR 5.0.2 before 8.5.0 Missing Re-Authentication for MFA Factor Deletion and U2F Registration",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authentication for Critical Function",
+                            "cweId": "CWE-306",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "5.0.2",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "5.0.2",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rcrp-xxch-gxfh",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rcrp-xxch-gxfh)"
+                },
+                {
+                    "url": "https://github.com/openemr/openemr/commit/e0dee295497bba763151913bde563a826c739cd7",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR 5.0.2 before 8.5.0 Missing Re-Authentication for MFA Factor Deletion and U2F Registration",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-5.0.2-before-8.5.0-missing-re-authentication-for-mfa-factor-deletion-and-u2f-registration"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "tonghuaroot",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126427.json b/data/2026/126xxx/CVE-2026-126427.json
new file mode 100644
index 0000000000..1e60a67c93
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126427.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126427",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:29.043Z",
+        "dateUpdated": "2026-11-13T09:35:29.043Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:29.043Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficient Session Expiration",
+                            "cweId": "CWE-613",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "PHYSICAL",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
+                        "attackVector": "PHYSICAL",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-fc6f-f47r-j9x8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fc6f-f47r-j9x8)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-idle-session-timeout-bypass-via-eye-exam-form"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Firehed",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126428.json b/data/2026/126xxx/CVE-2026-126428.json
new file mode 100644
index 0000000000..336443ab61
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126428.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126428",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:36:07.090Z",
+        "datePublished": "2026-11-13T09:35:28.362Z",
+        "dateUpdated": "2026-11-13T09:35:28.362Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:28.362Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Unrestricted Upload of File with Dangerous Type",
+                            "cweId": "CWE-434",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-r6wm-8m2j-c3q9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-r6wm-8m2j-c3q9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-rce-via-stored-era-upload-and-background-services"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126429.json b/data/2026/126xxx/CVE-2026-126429.json
new file mode 100644
index 0000000000..1c228b7d0b
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126429.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126429",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.684Z",
+        "datePublished": "2026-11-13T09:35:27.683Z",
+        "dateUpdated": "2026-11-13T09:35:27.683Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:27.683Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "External Control of File Name or Path",
+                            "cweId": "CWE-73",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-h4xc-pqg3-8459",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-h4xc-pqg3-8459)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-local-file-disclosure-via-doc-lib-php-pdf-renderer"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126430.json b/data/2026/126xxx/CVE-2026-126430.json
new file mode 100644
index 0000000000..fc32fecd51
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126430.json
@@ -0,0 +1,154 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126430",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:27.006Z",
+        "dateUpdated": "2026-11-13T09:35:27.006Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:27.006Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-wh28-4qcg-5hcc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wh28-4qcg-5hcc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-field-names"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "Sharwinreddy",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "SounLabs",
+                    "type": "analyst"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126431.json b/data/2026/126xxx/CVE-2026-126431.json
new file mode 100644
index 0000000000..7b3e52798f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126431.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126431",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:26.326Z",
+        "dateUpdated": "2026-11-13T09:35:26.326Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:26.326Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-8rgh-38j4-6pxf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8rgh-38j4-6pxf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-carecoordination-ccda-mapper"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126432.json b/data/2026/126xxx/CVE-2026-126432.json
new file mode 100644
index 0000000000..70850eefd2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126432.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126432",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:25.637Z",
+        "dateUpdated": "2026-11-13T09:35:25.637Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:25.637Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-3xjm-656g-cfj5",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3xjm-656g-cfj5)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-in-lab-order-transmission-via-list-reports-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126433.json b/data/2026/126xxx/CVE-2026-126433.json
new file mode 100644
index 0000000000..ad390ce4e1
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126433.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126433",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:24.960Z",
+        "dateUpdated": "2026-11-13T09:35:24.960Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:24.960Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Improper Authorization via dispense_drug.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drug_id, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-hp8p-h8g8-xmg3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hp8p-h8g8-xmg3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization via dispense_drug.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-dispense-drug-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126434.json b/data/2026/126xxx/CVE-2026-126434.json
new file mode 100644
index 0000000000..c503a05cc8
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126434.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126434",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:24.280Z",
+        "dateUpdated": "2026-11-13T09:35:24.280Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:24.280Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-q5c6-96vf-rx9v",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-q5c6-96vf-rx9v)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-procedure-order-form"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126435.json b/data/2026/126xxx/CVE-2026-126435.json
new file mode 100644
index 0000000000..0afae7af9d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126435.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126435",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:23.578Z",
+        "dateUpdated": "2026-11-13T09:35:23.578Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:23.578Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Access Control",
+                            "cweId": "CWE-284",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-xmjf-8fc9-hh38",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-xmjf-8fc9-hh38)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-order-manifest-php-lab-order-flags"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126436.json b/data/2026/126xxx/CVE-2026-126436.json
new file mode 100644
index 0000000000..01fc20f08f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126436.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126436",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:22.891Z",
+        "dateUpdated": "2026-11-13T09:35:22.891Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:22.891Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "NONE",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-qjj7-c4m9-6f92",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qjj7-c4m9-6f92)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-oauth2-grant-type-enforcement-bypass-via-token-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "sjpadgett",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126437.json b/data/2026/126xxx/CVE-2026-126437.json
new file mode 100644
index 0000000000..ce4d1c5777
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126437.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126437",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:22.181Z",
+        "dateUpdated": "2026-11-13T09:35:22.181Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:22.181Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-vc2h-x8xf-8jcv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-vc2h-x8xf-8jcv)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-portal-lib-download-template-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126438.json b/data/2026/126xxx/CVE-2026-126438.json
new file mode 100644
index 0000000000..73440601c1
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126438.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126438",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:37:25.685Z",
+        "datePublished": "2026-11-13T09:35:21.519Z",
+        "dateUpdated": "2026-11-13T09:35:21.519Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:21.519Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Improper Authorization in Clinical-Rule Editor patient_data.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-xqq3-59h5-xhmr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-xqq3-59h5-xhmr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Improper Authorization in Clinical-Rule Editor patient_data.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-in-clinical-rule-editor-patient-data-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126439.json b/data/2026/126xxx/CVE-2026-126439.json
new file mode 100644
index 0000000000..281e9a6897
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126439.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126439",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.342Z",
+        "datePublished": "2026-11-13T09:35:20.845Z",
+        "dateUpdated": "2026-11-13T09:35:20.845Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:20.845Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-7cfr-7h7r-f2x9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-7cfr-7h7r-f2x9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-c-cda-gateway-ccda-gateway-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126440.json b/data/2026/126xxx/CVE-2026-126440.json
new file mode 100644
index 0000000000..c1545a19c2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126440.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126440",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.342Z",
+        "datePublished": "2026-11-13T09:35:20.175Z",
+        "dateUpdated": "2026-11-13T09:35:20.175Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:20.175Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Access Control",
+                            "cweId": "CWE-284",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-mmpv-ph5x-x4m3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mmpv-ph5x-x4m3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-document-acl-bypass-via-care-coordination-import"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126441.json b/data/2026/126xxx/CVE-2026-126441.json
new file mode 100644
index 0000000000..44bb31027d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126441.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126441",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.342Z",
+        "datePublished": "2026-11-13T09:35:19.496Z",
+        "dateUpdated": "2026-11-13T09:35:19.496Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:19.496Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 IDOR via CAMOS rx_print.php Prescription Disclosure",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-gf9c-4hh8-gh49",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-gf9c-4hh8-gh49)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 IDOR via CAMOS rx_print.php Prescription Disclosure",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-via-camos-rx-print-php-prescription-disclosure"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126442.json b/data/2026/126xxx/CVE-2026-126442.json
new file mode 100644
index 0000000000..25c1a569ee
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126442.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126442",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.342Z",
+        "datePublished": "2026-11-13T09:35:18.835Z",
+        "dateUpdated": "2026-11-13T09:35:18.835Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:18.835Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-83hq-c876-fcwf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-83hq-c876-fcwf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-create-portallogin-php-portal-takeover"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126443.json b/data/2026/126xxx/CVE-2026-126443.json
new file mode 100644
index 0000000000..da9a9a026e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126443.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126443",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.342Z",
+        "datePublished": "2026-11-13T09:35:18.169Z",
+        "dateUpdated": "2026-11-13T09:35:18.169Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:18.169Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-79g8-hm7q-xrh4",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-79g8-hm7q-xrh4)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-dynamic-finder-ajax-php-patient-finder"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126444.json b/data/2026/126xxx/CVE-2026-126444.json
new file mode 100644
index 0000000000..b622f0bcb2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126444.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126444",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.343Z",
+        "datePublished": "2026-11-13T09:35:17.502Z",
+        "dateUpdated": "2026-11-13T09:35:17.502Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:17.502Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-mcr3-5rq6-9vvj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mcr3-5rq6-9vvj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ensora-erx-via-erx-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126445.json b/data/2026/126xxx/CVE-2026-126445.json
new file mode 100644
index 0000000000..37ef1079f3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126445.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126445",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.343Z",
+        "datePublished": "2026-11-13T09:35:16.819Z",
+        "dateUpdated": "2026-11-13T09:35:16.819Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:16.819Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in Patient Flow Board Tracker Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_tracker_status.php or drug_screen_completed.php to falsify check-in status, rooms, drug-screen completion, and tracker history."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-2984-qxv9-6r62",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2984-qxv9-6r62)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Patient Flow Board Tracker Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-patient-flow-board-tracker-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126446.json b/data/2026/126xxx/CVE-2026-126446.json
new file mode 100644
index 0000000000..46a051fa9b
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126446.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126446",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.343Z",
+        "datePublished": "2026-11-13T09:35:16.171Z",
+        "dateUpdated": "2026-11-13T09:35:16.171Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:16.171Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-pf2f-4xph-fhjx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-pf2f-4xph-fhjx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-destroyed-drugs-report-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126447.json b/data/2026/126xxx/CVE-2026-126447.json
new file mode 100644
index 0000000000..2fa41ba0d2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126447.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126447",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.343Z",
+        "datePublished": "2026-11-13T09:35:15.502Z",
+        "dateUpdated": "2026-11-13T09:35:15.502Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:15.502Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-vf9m-wg38-vcc2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-vf9m-wg38-vcc2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-trusted-messages-ajax-php-direct-messaging"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126448.json b/data/2026/126xxx/CVE-2026-126448.json
new file mode 100644
index 0000000000..72620d524f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126448.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126448",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:38:36.343Z",
+        "datePublished": "2026-11-13T09:35:14.807Z",
+        "dateUpdated": "2026-11-13T09:35:14.807Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:14.807Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php or add_context.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-m4cw-vx96-p6fj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-m4cw-vx96-p6fj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-nation-notes-configuration-handlers"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126449.json b/data/2026/126xxx/CVE-2026-126449.json
new file mode 100644
index 0000000000..fad12820bd
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126449.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126449",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:14.110Z",
+        "dateUpdated": "2026-11-13T09:35:14.110Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:14.110Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in immunizations.php, diagnosis_full.php, billing_process.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and billing_process.php that lets low-privileged users bypass ACL checks. Authenticated Front Office users can reuse their session CSRF token to add or delete immunizations, write encounter billing codes, and invoke the billing processor."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-xp7w-8fx3-642x",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-xp7w-8fx3-642x)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in immunizations.php, diagnosis_full.php, billing_process.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-immunizations-php-diagnosis-full-php-billing-process-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "d3do-23",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126450.json b/data/2026/126xxx/CVE-2026-126450.json
new file mode 100644
index 0000000000..7758068f53
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126450.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126450",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:13.396Z",
+        "dateUpdated": "2026-11-13T09:35:13.396Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:13.396Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Patient External ID in Prescriptions",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
+                            "cweId": "CWE-80",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-w2f7-289j-92pp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-w2f7-289j-92pp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Patient External ID in Prescriptions",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-patient-external-id-in-prescriptions"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "hekk-one",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126451.json b/data/2026/126xxx/CVE-2026-126451.json
new file mode 100644
index 0000000000..1b40e4c936
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126451.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126451",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:12.702Z",
+        "dateUpdated": "2026-11-13T09:35:12.702Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:12.702Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Document Template Rendering",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.5,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.3,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-hfpq-j3fj-cpmv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hfpq-j3fj-cpmv)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Document Template Rendering",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-document-template-rendering"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "PhilipPhil",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "gracia-gu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126452.json b/data/2026/126xxx/CVE-2026-126452.json
new file mode 100644
index 0000000000..7359240646
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126452.json
@@ -0,0 +1,154 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126452",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:12.032Z",
+        "dateUpdated": "2026-11-13T09:35:12.032Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:12.032Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-r65f-fxf6-4fwr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-r65f-fxf6-4fwr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-diagnosis-full-php-billing-operations"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "PhilipPhil",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "gracia-gu",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126453.json b/data/2026/126xxx/CVE-2026-126453.json
new file mode 100644
index 0000000000..0eed9d9d0d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126453.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126453",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:11.338Z",
+        "dateUpdated": "2026-11-13T09:35:11.338Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:11.338Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Inverted Document Expiration Check Exposes PHI via FHIR Binary",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficient Session Expiration",
+                            "cweId": "CWE-613",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-fp98-qfh5-xjhc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fp98-qfh5-xjhc)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Inverted Document Expiration Check Exposes PHI via FHIR Binary",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-inverted-document-expiration-check-exposes-phi-via-fhir-binary"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sharwinreddy",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "sriharsha1994",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126454.json b/data/2026/126xxx/CVE-2026-126454.json
new file mode 100644
index 0000000000..61b22a0808
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126454.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126454",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:10.666Z",
+        "dateUpdated": "2026-11-13T09:35:10.666Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:10.666Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth2",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to main_screen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass two-factor authentication."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Restriction of Excessive Authentication Attempts",
+                            "cweId": "CWE-307",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rp7c-25mm-8g74",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rp7c-25mm-8g74)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth2",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-totp-brute-force-via-main-screen-php-and-oauth2"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "PhilipPhil",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "gracia-gu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126455.json b/data/2026/126xxx/CVE-2026-126455.json
new file mode 100644
index 0000000000..b4a5574f99
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126455.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126455",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:09.982Z",
+        "dateUpdated": "2026-11-13T09:35:09.982Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:09.982Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-vr7f-7c3w-49g7",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-vr7f-7c3w-49g7)"
+                },
+                {
+                    "url": "https://github.com/openemr/openemr/commit/71da6605dc3bcc1405ee9a65cb9f579ecbc8a1c6",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-privilege-escalation-via-missing-authorization-and-sql-injection"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "AdamKorcz",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126456.json b/data/2026/126xxx/CVE-2026-126456.json
new file mode 100644
index 0000000000..8da43fe9a2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126456.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126456",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:09.311Z",
+        "dateUpdated": "2026-11-13T09:35:09.311Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:09.311Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users' browsers."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-ff55-qvf9-2fgm",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-ff55-qvf9-2fgm)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-fee-sheet-notecodes-field"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "AdamKorcz",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126457.json b/data/2026/126xxx/CVE-2026-126457.json
new file mode 100644
index 0000000000..569c6482b4
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126457.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126457",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.377Z",
+        "datePublished": "2026-11-13T09:35:08.617Z",
+        "dateUpdated": "2026-11-13T09:35:08.617Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:08.617Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in InstallerController Module Actions",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-32cq-gh7x-jpqw",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-32cq-gh7x-jpqw)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in InstallerController Module Actions",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-installercontroller-module-actions"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "AdamKorcz",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126458.json b/data/2026/126xxx/CVE-2026-126458.json
new file mode 100644
index 0000000000..b85b2435ea
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126458.json
@@ -0,0 +1,156 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126458",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:39:26.378Z",
+        "datePublished": "2026-11-13T09:35:07.943Z",
+        "dateUpdated": "2026-11-13T09:35:07.943Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:07.943Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-j467-662w-jwvj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-j467-662w-jwvj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-authorizations-full-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "skeletonsec",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "Leousum",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126460.json b/data/2026/126xxx/CVE-2026-126460.json
new file mode 100644
index 0000000000..1c3052d3a9
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126460.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126460",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.742Z",
+        "datePublished": "2026-11-13T09:35:07.214Z",
+        "dateUpdated": "2026-11-13T09:35:07.214Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:07.214Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-hqjp-rcv8-7p9c",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hqjp-rcv8-7p9c)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-persistent-sql-injection-via-era-file-reprocessing"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "360AlphaLab",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126461.json b/data/2026/126xxx/CVE-2026-126461.json
new file mode 100644
index 0000000000..13506eacfa
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126461.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126461",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.742Z",
+        "datePublished": "2026-11-13T09:35:06.538Z",
+        "dateUpdated": "2026-11-13T09:35:06.538Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:06.538Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service hosts like CouchDB, eRx, phiMail, or SMTP to attacker-controlled servers, exfiltrating system credentials and patient PHI."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Server-Side Request Forgery (SSRF)",
+                            "cweId": "CWE-918",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-prmv-3m3j-9v7j",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-prmv-3m3j-9v7j)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-user-settings-php-global-override"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126462.json b/data/2026/126xxx/CVE-2026-126462.json
new file mode 100644
index 0000000000..851c7f5d7e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126462.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126462",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.742Z",
+        "datePublished": "2026-11-13T09:35:05.862Z",
+        "dateUpdated": "2026-11-13T09:35:05.862Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:05.862Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Eye Exam Next Visit Orders",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rgv4-6mf9-hxwx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rgv4-6mf9-hxwx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Eye Exam Next Visit Orders",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-next-visit-orders"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "pavelkohout396",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126463.json b/data/2026/126xxx/CVE-2026-126463.json
new file mode 100644
index 0000000000..f4710b6f66
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126463.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126463",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.742Z",
+        "datePublished": "2026-11-13T09:35:05.238Z",
+        "dateUpdated": "2026-11-13T09:35:05.238Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:05.238Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-g7m7-pc2p-7h7q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-g7m7-pc2p-7h7q)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-billing-parser-reports-zend-modules"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126464.json b/data/2026/126xxx/CVE-2026-126464.json
new file mode 100644
index 0000000000..63a49fc858
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126464.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126464",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.743Z",
+        "datePublished": "2026-11-13T09:35:04.627Z",
+        "dateUpdated": "2026-11-13T09:35:04.627Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:04.627Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Server-Side Request Forgery (SSRF)",
+                            "cweId": "CWE-918",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wc8m-q5xj-j34x)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126465.json b/data/2026/126xxx/CVE-2026-126465.json
new file mode 100644
index 0000000000..5d5e960f2f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126465.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126465",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.743Z",
+        "datePublished": "2026-11-13T09:35:03.882Z",
+        "dateUpdated": "2026-11-13T09:35:03.882Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:03.882Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-vvj8-xpx8-p293",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-vvj8-xpx8-p293)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsiteactivityview-bitwiseand-criteria"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126466.json b/data/2026/126xxx/CVE-2026-126466.json
new file mode 100644
index 0000000000..0e600ea0ce
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126466.json
@@ -0,0 +1,156 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126466",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.743Z",
+        "datePublished": "2026-11-13T09:35:03.207Z",
+        "dateUpdated": "2026-11-13T09:35:03.207Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:03.207Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query new_search_popup.php and patient_select.php to leak names, SSNs and DOBs."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-cwpg-qv34-gx8x",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-cwpg-qv34-gx8x)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-patient-create-and-search-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126467.json b/data/2026/126xxx/CVE-2026-126467.json
new file mode 100644
index 0000000000..fe9752569e
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126467.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126467",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.743Z",
+        "datePublished": "2026-11-13T09:35:02.519Z",
+        "dateUpdated": "2026-11-13T09:35:02.519Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:02.519Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
+                            "cweId": "CWE-915",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-qv6p-57wj-w55p",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qv6p-57wj-w55p)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-mass-assignment-via-observation-form-save-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126468.json b/data/2026/126xxx/CVE-2026-126468.json
new file mode 100644
index 0000000000..b7ec9e7ccb
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126468.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126468",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.743Z",
+        "datePublished": "2026-11-13T09:35:01.841Z",
+        "dateUpdated": "2026-11-13T09:35:01.841Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:01.841Z"
+            },
+            "datePublic": "2026-10-27T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6h9j-m5w9-8938",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6h9j-m5w9-8938)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-on-reports-and-reminder-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126469.json b/data/2026/126xxx/CVE-2026-126469.json
new file mode 100644
index 0000000000..4f27a94e0b
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126469.json
@@ -0,0 +1,156 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126469",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:41:28.743Z",
+        "datePublished": "2026-11-13T09:35:01.156Z",
+        "dateUpdated": "2026-11-13T09:35:01.156Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:01.156Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-3h5w-672p-v4m9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3h5w-672p-v4m9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-custom-export-and-chart-tracker-scripts"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126470.json b/data/2026/126xxx/CVE-2026-126470.json
new file mode 100644
index 0000000000..9efb29d294
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126470.json
@@ -0,0 +1,176 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126470",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:35:00.497Z",
+        "dateUpdated": "2026-11-13T09:35:00.497Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:35:00.497Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-3vxh-7hh5-vhhm",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3vxh-7hh5-vhhm)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-in-carecoordination-ccda-ccr-qrda-document-actions"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Nora-Qiu",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "christos-cantina-security",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "SounLabs",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "PhilipPhil",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "gracia-gu",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126471.json b/data/2026/126xxx/CVE-2026-126471.json
new file mode 100644
index 0000000000..de16820ffc
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126471.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126471",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:59.825Z",
+        "dateUpdated": "2026-11-13T09:34:59.825Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:59.825Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via print_referral.php and trend_form.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-h9rv-wxcp-x85f",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-h9rv-wxcp-x85f)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via print_referral.php and trend_form.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-print-referral-php-and-trend-form-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sultan0f1",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126472.json b/data/2026/126xxx/CVE-2026-126472.json
new file mode 100644
index 0000000000..4e962e809f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126472.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126472",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:59.148Z",
+        "dateUpdated": "2026-11-13T09:34:59.148Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:59.148Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosure",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6fxw-69cq-m7g6",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6fxw-69cq-m7g6)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosure",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ccdaservice-ccda-gateway-php-c-cda-disclosure"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "skeletonsec",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126473.json b/data/2026/126xxx/CVE-2026-126473.json
new file mode 100644
index 0000000000..bb448e9fe3
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126473.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126473",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:58.505Z",
+        "dateUpdated": "2026-11-13T09:34:58.505Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:58.505Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.4.0"
+                        },
+                        {
+                            "version": "8.4.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.3,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6xh3-fmm5-jjp4",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6xh3-fmm5-jjp4)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.4.0-oauth-authorization-bypass-via-scope-canonicalization"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "mcspicyenjoyer",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126474.json b/data/2026/126xxx/CVE-2026-126474.json
new file mode 100644
index 0000000000..4e5e3736b8
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126474.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126474",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:57.820Z",
+        "dateUpdated": "2026-11-13T09:34:57.820Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:57.820Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-mccm-83g2-7v57",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mccm-83g2-7v57)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-acl-module-module-id-parameter"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "milo2012",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126475.json b/data/2026/126xxx/CVE-2026-126475.json
new file mode 100644
index 0000000000..7dcc1e6208
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126475.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126475",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:57.138Z",
+        "dateUpdated": "2026-11-13T09:34:57.138Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:57.138Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Reflected XSS via searchEleNo in Auto-Suggest Endpoint",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-pv5m-vjm7-x355",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-pv5m-vjm7-x355)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Reflected XSS via searchEleNo in Auto-Suggest Endpoint",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-searcheleno-in-auto-suggest-endpoint"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "milo2012",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126476.json b/data/2026/126xxx/CVE-2026-126476.json
new file mode 100644
index 0000000000..8a69167fcf
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126476.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126476",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:56.473Z",
+        "dateUpdated": "2026-11-13T09:34:56.473Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:56.473Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Reflected XSS via auto-suggest searchMode parameter",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "NONE",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-8mwp-vq82-x5mr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8mwp-vq82-x5mr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Reflected XSS via auto-suggest searchMode parameter",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-auto-suggest-searchmode-parameter"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "milo2012",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126477.json b/data/2026/126xxx/CVE-2026-126477.json
new file mode 100644
index 0000000000..242b5fed3c
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126477.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126477",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:55.801Z",
+        "dateUpdated": "2026-11-13T09:34:55.801Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:55.801Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 4.6,
+                        "baseSeverity": "MEDIUM",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "HIGH",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "scope": "CHANGED",
+                        "userInteraction": "REQUIRED",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-gr77-7xgh-5gwf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-gr77-7xgh-5gwf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-defaults-in-eye-base-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "milo2012",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126478.json b/data/2026/126xxx/CVE-2026-126478.json
new file mode 100644
index 0000000000..a3330a11cd
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126478.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126478",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:55.106Z",
+        "dateUpdated": "2026-11-13T09:34:55.106Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:55.106Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via form_icd_codes in Syndromic Surveillance",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-q6f8-4pm7-q39r",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-q6f8-4pm7-q39r)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via form_icd_codes in Syndromic Surveillance",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-form-icd-codes-in-syndromic-surveillance"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "SounLabs",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126479.json b/data/2026/126xxx/CVE-2026-126479.json
new file mode 100644
index 0000000000..dcd448b7d0
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126479.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126479",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:42:24.800Z",
+        "datePublished": "2026-11-13T09:34:54.427Z",
+        "dateUpdated": "2026-11-13T09:34:54.427Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:54.427Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization in Module Manager Installer Actions",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-gpcx-xcp2-2rhx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-gpcx-xcp2-2rhx)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization in Module Manager Installer Actions",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-module-manager-installer-actions"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "L0stHeart",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126480.json b/data/2026/126xxx/CVE-2026-126480.json
new file mode 100644
index 0000000000..af3cb7ca25
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126480.json
@@ -0,0 +1,154 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126480",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.725Z",
+        "datePublished": "2026-11-13T09:34:53.694Z",
+        "dateUpdated": "2026-11-13T09:34:53.694Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:53.694Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-86hf-j825-r56h",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-86hf-j825-r56h)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-parameter-names"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "energytag6",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "SounLabs",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126481.json b/data/2026/126xxx/CVE-2026-126481.json
new file mode 100644
index 0000000000..60f2a9433f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126481.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126481",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:52.945Z",
+        "dateUpdated": "2026-11-13T09:34:52.945Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:52.945Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Path Traversal via ERA 835 File Upload",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-mf55-7h68-r2rp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mf55-7h68-r2rp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Path Traversal via ERA 835 File Upload",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-path-traversal-via-era-835-file-upload"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "energytag6",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126482.json b/data/2026/126xxx/CVE-2026-126482.json
new file mode 100644
index 0000000000..1070ef8395
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126482.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126482",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:52.242Z",
+        "dateUpdated": "2026-11-13T09:34:52.242Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:52.242Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-cw3f-mhw8-44jp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-cw3f-mhw8-44jp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-clp01-element-of-x12-835-era-upload"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "energytag6",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "360AlphaLab",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126483.json b/data/2026/126xxx/CVE-2026-126483.json
new file mode 100644
index 0000000000..51b8542380
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126483.json
@@ -0,0 +1,159 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126483",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:51.565Z",
+        "dateUpdated": "2026-11-13T09:34:51.565Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:51.565Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via form_facility in ippf_statistics.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-p2ch-6856-w69j",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-p2ch-6856-w69j)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via form_facility in ippf_statistics.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-form-facility-in-ippf-statistics-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "arpitjain099",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "PhilipPhil",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "gracia-gu",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126484.json b/data/2026/126xxx/CVE-2026-126484.json
new file mode 100644
index 0000000000..2dac7ccab2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126484.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126484",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:50.915Z",
+        "dateUpdated": "2026-11-13T09:34:50.915Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:50.915Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-c997-5w2m-grrf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-c997-5w2m-grrf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-printed-fee-sheet-appointment-comments"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "arpitjain099",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126485.json b/data/2026/126xxx/CVE-2026-126485.json
new file mode 100644
index 0000000000..ee1f889ae6
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126485.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126485",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:50.219Z",
+        "dateUpdated": "2026-11-13T09:34:50.219Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:50.219Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 CSRF via Observation Form delete.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values, soft-deleting observations in the victim's open encounter."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Cross-Site Request Forgery (CSRF)",
+                            "cweId": "CWE-352",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-7gjr-359j-5q93",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-7gjr-359j-5q93)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 CSRF via Observation Form delete.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-csrf-via-observation-form-delete-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "arpitjain099",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126486.json b/data/2026/126xxx/CVE-2026-126486.json
new file mode 100644
index 0000000000..16167ac3ed
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126486.json
@@ -0,0 +1,154 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126486",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:49.523Z",
+        "dateUpdated": "2026-11-13T09:34:49.523Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:49.523Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Missing Authorization via portal/import_template.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=save_profiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-phvv-q7m7-8mc2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-phvv-q7m7-8mc2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via portal/import_template.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-portal-import-template-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Alpastx",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "robinpie",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126487.json b/data/2026/126xxx/CVE-2026-126487.json
new file mode 100644
index 0000000000..a7c0265a89
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126487.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126487",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:48.664Z",
+        "dateUpdated": "2026-11-13T09:34:48.664Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:48.664Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Global Configuration Override via user_settings.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/user_settings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Privilege Management",
+                            "cweId": "CWE-269",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-v997-jphq-wvvr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-v997-jphq-wvvr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Global Configuration Override via user_settings.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-global-configuration-override-via-user-settings-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Firehed",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126488.json b/data/2026/126xxx/CVE-2026-126488.json
new file mode 100644
index 0000000000..46ae2358f2
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126488.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126488",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:47.993Z",
+        "dateUpdated": "2026-11-13T09:34:47.993Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:47.993Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-g2xw-rvhq-x543",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-g2xw-rvhq-x543)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsitedocument-query-bitwiseand"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "kah-ja",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126489.json b/data/2026/126xxx/CVE-2026-126489.json
new file mode 100644
index 0000000000..915c6b8d18
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126489.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126489",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:44:28.726Z",
+        "datePublished": "2026-11-13T09:34:47.310Z",
+        "dateUpdated": "2026-11-13T09:34:47.310Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:47.310Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious field_id via edit_layout.php, then trigger issue_ippf_con_save through add_edit_issue.php to execute arbitrary SQL."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-8j6v-q545-q9q7",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8j6v-q545-q9q7)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ippf-contraceptive-issue-feature"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "ChrisSub08",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126490.json b/data/2026/126xxx/CVE-2026-126490.json
new file mode 100644
index 0000000000..23964dcc29
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126490.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126490",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:45:21.806Z",
+        "datePublished": "2026-11-13T09:34:45.798Z",
+        "dateUpdated": "2026-11-13T09:34:45.798Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:45.798Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru(\"groups\") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.1,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-wc2f-fvpv-c32r",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wc2f-fvpv-c32r)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-information-disclosure-via-debug-code-in-fax-view-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Pig-Tail",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126491.json b/data/2026/126xxx/CVE-2026-126491.json
new file mode 100644
index 0000000000..83499f8610
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126491.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126491",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:45:21.806Z",
+        "datePublished": "2026-11-13T09:34:45.073Z",
+        "dateUpdated": "2026-11-13T09:34:45.073Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:45.073Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 SQL Injection via getByPatientDemographics in patient.inc.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options field_id values are concatenated into the patient search WHERE clause. Attackers with Layout Editor access can plant a malicious field_id, allowing any authenticated low-privilege user to exfiltrate data from patient_data and users_secure tables."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-pc2q-9pcw-v899",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-pc2q-9pcw-v899)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via getByPatientDemographics in patient.inc.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-getbypatientdemographics-in-patient-inc-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "StarPlatinu",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126492.json b/data/2026/126xxx/CVE-2026-126492.json
new file mode 100644
index 0000000000..7ad6fdeedd
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126492.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126492",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:45:21.806Z",
+        "datePublished": "2026-11-13T09:34:43.205Z",
+        "dateUpdated": "2026-11-13T09:34:43.205Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:43.205Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Second-Order SQL Injection via dynamic_finder.php",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                            "cweId": "CWE-89",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-hrf6-qx6w-vgh9",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hrf6-qx6w-vgh9)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Second-Order SQL Injection via dynamic_finder.php",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-dynamic-finder-php"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126493.json b/data/2026/126xxx/CVE-2026-126493.json
new file mode 100644
index 0000000000..e6ca6270c7
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126493.json
@@ -0,0 +1,144 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126493",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:45:21.806Z",
+        "datePublished": "2026-11-13T09:34:42.519Z",
+        "dateUpdated": "2026-11-13T09:34:42.519Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:42.519Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.5.0"
+                        },
+                        {
+                            "version": "8.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.5.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "ACTIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-r4hm-frcj-qr39",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-r4hm-frcj-qr39)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-onsiteportalactivity-tableargs"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Leousum",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126494.json b/data/2026/126xxx/CVE-2026-126494.json
new file mode 100644
index 0000000000..b640351097
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126494.json
@@ -0,0 +1,154 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126494",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-10T21:45:21.807Z",
+        "datePublished": "2026-11-13T09:34:41.832Z",
+        "dateUpdated": "2026-11-13T09:34:41.832Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:41.832Z"
+            },
+            "datePublic": "2026-10-28T00:00:00.000Z",
+            "title": "OpenEMR before 8.4.0 Privilege Escalation via SMART/OAuth Scope Finalization",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "openemr",
+                    "product": "openemr",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "8.4.0"
+                        },
+                        {
+                            "version": "8.4.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "8.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6cmr-r2rh-755m",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6cmr-r2rh-755m)"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenEMR before 8.4.0 Privilege Escalation via SMART/OAuth Scope Finalization",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openemr-before-8.4.0-privilege-escalation-via-smart-oauth-scope-finalization"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "christos-cantina-security",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "kojiromike",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "mcspicyenjoyer",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126936.json b/data/2026/126xxx/CVE-2026-126936.json
new file mode 100644
index 0000000000..9c038cff8d
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126936.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126936",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.843Z",
+        "datePublished": "2026-11-13T09:34:41.165Z",
+        "dateUpdated": "2026-11-13T09:34:41.165Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:41.165Z"
+            },
+            "datePublic": "2026-08-16T00:00:00.000Z",
+            "title": "Zipline before 4.7.0 Race Condition in Invite and Quota Limits",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
+                            "cweId": "CWE-367",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.7.0"
+                        },
+                        {
+                            "version": "4.7.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-wq7g-g9f8-8q2p",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wq7g-g9f8-8q2p)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.7.0 Race Condition in Invite and Quota Limits",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.7.0-race-condition-in-invite-and-quota-limits"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "tonghuaroot",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126937.json b/data/2026/126xxx/CVE-2026-126937.json
new file mode 100644
index 0000000000..f8619bdf03
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126937.json
@@ -0,0 +1,132 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126937",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:40.499Z",
+        "dateUpdated": "2026-11-13T09:34:40.499Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:40.499Z"
+            },
+            "datePublic": "2026-07-28T00:00:00.000Z",
+            "title": "Zipline before 4.6.5 TOCTOU Race Condition via /api/setup",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
+                            "cweId": "CWE-367",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.6.5"
+                        },
+                        {
+                            "version": "4.6.5",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-wgjv-p9mm-qw77",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wgjv-p9mm-qw77)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.6.5 TOCTOU Race Condition via /api/setup",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.6.5-toctou-race-condition-via-api-setup"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "EQSTLab",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "min8282",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126938.json b/data/2026/126xxx/CVE-2026-126938.json
new file mode 100644
index 0000000000..053baa2305
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126938.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126938",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:39.833Z",
+        "dateUpdated": "2026-11-13T09:34:39.833Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:39.833Z"
+            },
+            "datePublic": "2026-07-06T00:00:00.000Z",
+            "title": "Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.6.4"
+                        },
+                        {
+                            "version": "4.6.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-fp8p-hf8g-fw65",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fp8p-hf8g-fw65)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.6.4-upload-quota-bypass-via-forged-content-range-headers"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "superintendent2521",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126939.json b/data/2026/126xxx/CVE-2026-126939.json
new file mode 100644
index 0000000000..7f9e4140a7
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126939.json
@@ -0,0 +1,128 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126939",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:39.144Z",
+        "dateUpdated": "2026-11-13T09:34:39.144Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:39.144Z"
+            },
+            "datePublic": "2026-07-06T00:00:00.000Z",
+            "title": "Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/zipline",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.6.4"
+                        },
+                        {
+                            "version": "4.6.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-jh6v-w5f3-8p4x",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-jh6v-w5f3-8p4x)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.6.4-unauthenticated-file-listing-via-page-query-parameter"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "de3erve-hunter",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126940.json b/data/2026/126xxx/CVE-2026-126940.json
new file mode 100644
index 0000000000..b2d0f8ddfc
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126940.json
@@ -0,0 +1,128 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126940",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:38.463Z",
+        "dateUpdated": "2026-11-13T09:34:38.463Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:38.463Z"
+            },
+            "datePublic": "2026-07-06T00:00:00.000Z",
+            "title": "Zipline before 4.6.4 Rate Limit Bypass via Query String and Header",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Restriction of Excessive Authentication Attempts",
+                            "cweId": "CWE-307",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/zipline",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.6.4"
+                        },
+                        {
+                            "version": "4.6.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-2qgq-hv52-jhqq",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2qgq-hv52-jhqq)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.6.4 Rate Limit Bypass via Query String and Header",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.6.4-rate-limit-bypass-via-query-string-and-header"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "de3erve-hunter",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126941.json b/data/2026/126xxx/CVE-2026-126941.json
new file mode 100644
index 0000000000..7982cb08c5
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126941.json
@@ -0,0 +1,122 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126941",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:37.786Z",
+        "dateUpdated": "2026-11-13T09:34:37.786Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:37.786Z"
+            },
+            "datePublic": "2026-06-26T00:00:00.000Z",
+            "title": "Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.6.2"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8643-cr38-p6qj)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-through-4.6.2-privilege-escalation-via-missing-role-checks-on-user-endpoints"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "CyberKareem",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126942.json b/data/2026/126xxx/CVE-2026-126942.json
new file mode 100644
index 0000000000..b2a086ef26
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126942.json
@@ -0,0 +1,128 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126942",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:37.092Z",
+        "dateUpdated": "2026-11-13T09:34:37.092Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:37.092Z"
+            },
+            "datePublic": "2026-06-03T00:00:00.000Z",
+            "title": "Zipline before 4.6.2 Missing Authorization via POST /api/user/folders",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/zipline",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.6.2"
+                        },
+                        {
+                            "version": "4.6.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-84c9-r2mj-p9pp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-84c9-r2mj-p9pp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.6.2 Missing Authorization via POST /api/user/folders",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.6.2-missing-authorization-via-post-api-user-folders"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "dizconnectz",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126943.json b/data/2026/126xxx/CVE-2026-126943.json
new file mode 100644
index 0000000000..375bed9a50
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126943.json
@@ -0,0 +1,128 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126943",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:36.421Z",
+        "dateUpdated": "2026-11-13T09:34:36.421Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:36.421Z"
+            },
+            "datePublic": "2026-06-03T00:00:00.000Z",
+            "title": "Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insertion of Sensitive Information into Log File",
+                            "cweId": "CWE-532",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/zipline",
+                    "versions": [
+                        {
+                            "version": "4.2.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.6.2"
+                        },
+                        {
+                            "version": "4.6.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-2h25-m8rf-v86j",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2h25-m8rf-v86j)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-4.2.0-before-4.6.2-oauth2-client-secret-leakage-in-startup-logs"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "soopyc",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126944.json b/data/2026/126xxx/CVE-2026-126944.json
new file mode 100644
index 0000000000..3ad7a2f859
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126944.json
@@ -0,0 +1,128 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126944",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:35.737Z",
+        "dateUpdated": "2026-11-13T09:34:35.737Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:35.737Z"
+            },
+            "datePublic": "2026-05-20T00:00:00.000Z",
+            "title": "Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/zipline",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.6.1"
+                        },
+                        {
+                            "version": "4.6.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.7,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-gr35-qcpp-65w5",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-gr35-qcpp-65w5)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.6.1-path-traversal-via-imported-filenames-in-localdatasource"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "EndlssNightmare",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126945.json b/data/2026/126xxx/CVE-2026-126945.json
new file mode 100644
index 0000000000..ce9019f6bc
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126945.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126945",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:56:41.844Z",
+        "datePublished": "2026-11-13T09:34:35.069Z",
+        "dateUpdated": "2026-11-13T09:34:35.069Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:35.069Z"
+            },
+            "datePublic": "2026-03-28T00:00:00.000Z",
+            "title": "Zipline before 4.5.1 Stored XSS via HighlightCode Component",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.5.1"
+                        },
+                        {
+                            "version": "4.5.1",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.3,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-m649-gvwx-j6qv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-m649-gvwx-j6qv)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.5.1 Stored XSS via HighlightCode Component",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.5.1-stored-xss-via-highlightcode-component"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "mtolley",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126946.json b/data/2026/126xxx/CVE-2026-126946.json
new file mode 100644
index 0000000000..933a75afd6
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126946.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126946",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:34.387Z",
+        "dateUpdated": "2026-11-13T09:34:34.387Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:34.387Z"
+            },
+            "datePublic": "2026-03-21T00:00:00.000Z",
+            "title": "Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "4.3.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.5.0"
+                        },
+                        {
+                            "version": "4.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-9j96-vvqc-h9f8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9j96-vvqc-h9f8)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-4.3.0-before-4.5.0-stored-xss-via-ssr-embed-meta-tags"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "kq5y",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126947.json b/data/2026/126xxx/CVE-2026-126947.json
new file mode 100644
index 0000000000..6bec6b34c5
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126947.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126947",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:33.705Z",
+        "dateUpdated": "2026-11-13T09:34:33.705Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:33.705Z"
+            },
+            "datePublic": "2026-03-21T00:00:00.000Z",
+            "title": "Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "URL Redirection to Untrusted Site ('Open Redirect')",
+                            "cweId": "CWE-601",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.5.0"
+                        },
+                        {
+                            "version": "4.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-6q69-pgmp-w93c",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6q69-pgmp-w93c)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.5.0-stored-open-redirect-via-post-api-user-urls"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Hussien-Alzaghateet",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126948.json b/data/2026/126xxx/CVE-2026-126948.json
new file mode 100644
index 0000000000..0120879153
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126948.json
@@ -0,0 +1,128 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126948",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:33.024Z",
+        "dateUpdated": "2026-11-13T09:34:33.024Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:33.024Z"
+            },
+            "datePublic": "2026-03-21T00:00:00.000Z",
+            "title": "Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:npm/zipline",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.5.0"
+                        },
+                        {
+                            "version": "4.5.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV4_0": {
+                        "Automatable": "NOT_DEFINED",
+                        "Recovery": "NOT_DEFINED",
+                        "Safety": "NOT_DEFINED",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "attackVector": "NETWORK",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH",
+                        "exploitMaturity": "NOT_DEFINED",
+                        "privilegesRequired": "LOW",
+                        "providerUrgency": "NOT_DEFINED",
+                        "subAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "userInteraction": "NONE",
+                        "valueDensity": "NOT_DEFINED",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "version": "4.0",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnerabilityResponseEffort": "NOT_DEFINED"
+                    },
+                    "format": "CVSS"
+                },
+                {
+                    "cvssV3_1": {
+                        "attackComplexity": "LOW",
+                        "attackVector": "NETWORK",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "scope": "UNCHANGED",
+                        "userInteraction": "NONE",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "version": "3.1"
+                    },
+                    "format": "CVSS"
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fgwh-2pc5-wr73)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-before-4.5.0-idor-via-folder-patch-and-delete-endpoints"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126949.json b/data/2026/126xxx/CVE-2026-126949.json
new file mode 100644
index 0000000000..97f7085efe
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126949.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126949",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:32.349Z",
+        "dateUpdated": "2026-11-13T09:34:32.349Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:32.349Z"
+            },
+            "datePublic": "2026-01-20T00:00:00.000Z",
+            "title": "Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-rw9m-7mvm-6gxp",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rw9m-7mvm-6gxp)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-file-overwrite-via-patch-api-user-files-id"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "nojomyth-dev",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126950.json b/data/2026/126xxx/CVE-2026-126950.json
new file mode 100644
index 0000000000..12b000f828
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126950.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126950",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:31.656Z",
+        "dateUpdated": "2026-11-13T09:34:31.656Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:31.656Z"
+            },
+            "datePublic": "2026-01-20T00:00:00.000Z",
+            "title": "Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-2wfm-prg7-x586",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2wfm-prg7-x586)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-arbitrary-file-delete-via-x-zipline-file-extension"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "nojomyth-dev",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126951.json b/data/2026/126xxx/CVE-2026-126951.json
new file mode 100644
index 0000000000..eeecb6047a
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126951.json
@@ -0,0 +1,105 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126951",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:30.968Z",
+        "dateUpdated": "2026-11-13T09:34:30.968Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:30.968Z"
+            },
+            "datePublic": "2026-01-20T00:00:00.000Z",
+            "title": "Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-8xjg-qm2p-75gm",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8xjg-qm2p-75gm)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-authenticated-path-traversal-via-api-user-files-id-raw"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "nojomyth-dev",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126952.json b/data/2026/126xxx/CVE-2026-126952.json
new file mode 100644
index 0000000000..de0096c379
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126952.json
@@ -0,0 +1,122 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126952",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:30.285Z",
+        "dateUpdated": "2026-11-13T09:34:30.285Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:30.285Z"
+            },
+            "datePublic": "2026-01-20T00:00:00.000Z",
+            "title": "Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Verification of Cryptographic Signature",
+                            "cweId": "CWE-347",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "diced",
+                    "product": "zipline",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8g3f-425r-35rq)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-webauthn-authentication-bypass-via-passkey-login"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "nojomyth-dev",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126953.json b/data/2026/126xxx/CVE-2026-126953.json
new file mode 100644
index 0000000000..09725f40d7
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126953.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126953",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:29.604Z",
+        "dateUpdated": "2026-11-13T09:34:29.604Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:29.604Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Username",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that set_UserUsername() in obuspa_system.lua passes to os.execute(), gaining root command execution."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                            "cweId": "CWE-78",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Username",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-os-command-injection-via-tr-098-user-username"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126954.json b/data/2026/126xxx/CVE-2026-126954.json
new file mode 100644
index 0000000000..04a233828f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126954.json
@@ -0,0 +1,179 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126954",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:28.893Z",
+        "dateUpdated": "2026-11-13T09:34:28.893Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:28.893Z"
+            },
+            "datePublic": "2026-11-07T16:25:56.000Z",
+            "title": "Glance 0.7.9 before 0.8.8 Stored XSS via Widget-Title-URL Header",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "glanceapp",
+                    "product": "glance",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0.7.9",
+                            "lessThan": "0.8.8",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:golang/github.com/glanceapp/glance",
+                    "repo": "https://github.com/glanceapp/glance"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:glance_project:glance:*:*:*:*:*:-:*:*",
+                                    "versionStartIncluding": "0.7.9",
+                                    "versionEndExcluding": "0.8.8"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.7,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/glanceapp/glance/security/advisories/GHSA-96x7-3hwp-rcfc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-96x7-3hwp-rcfc)"
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/security/advisories/GHSA-f2c4-p935-ffpj",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-f2c4-p935-ffpj)"
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/widget-extension.go#L151-L152",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/templates/widget-base.html#L5",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/releases/tag/v0.8.8",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "glance v0.8.8 Release Notes"
+                },
+                {
+                    "name": "VulnCheck Advisory: Glance 0.7.9 before 0.8.8 Stored XSS via Widget-Title-URL Header",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/glance-0.7.9-before-0.8.8-stored-xss-via-widget-title-url-header"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Svilen Markov",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126955.json b/data/2026/126xxx/CVE-2026-126955.json
new file mode 100644
index 0000000000..c54da73aea
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126955.json
@@ -0,0 +1,166 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-126955",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-11T22:57:48.492Z",
+        "datePublished": "2026-11-13T09:34:28.194Z",
+        "dateUpdated": "2026-11-13T09:34:28.194Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:28.194Z"
+            },
+            "datePublic": "2026-11-07T16:30:32.000Z",
+            "title": "Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Observable Response Discrepancy",
+                            "cweId": "CWE-204",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "glanceapp",
+                    "product": "glance",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0.8.0",
+                            "lessThan": "0.8.8",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:golang/github.com/glanceapp/glance",
+                    "repo": "https://github.com/glanceapp/glance"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:glance_project:glance:*:*:*:*:*:-:*:*",
+                                    "versionStartIncluding": "0.8.0",
+                                    "versionEndExcluding": "0.8.8"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-294x-cjq2-6j5r)"
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/glanceapp/glance/releases/tag/v0.8.8",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "glance v0.8.8 Release Notes"
+                },
+                {
+                    "name": "VulnCheck Advisory: Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Svilen Markov",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127073.json b/data/2026/127xxx/CVE-2026-127073.json
new file mode 100644
index 0000000000..7a47cc3112
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127073.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127073",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:07.370Z",
+        "datePublished": "2026-11-13T09:34:27.520Z",
+        "dateUpdated": "2026-11-13T09:34:27.520Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:27.520Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Privilege Management",
+                            "cweId": "CWE-269",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "HIGH",
+                        "baseScore": 9.4,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 9.9,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/7bc715e190e5be2c2fc5be15c4035ce7",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-privilege-escalation-via-additional-manifest"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127074.json b/data/2026/127xxx/CVE-2026-127074.json
new file mode 100644
index 0000000000..a43f6ecf0f
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127074.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127074",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:07.767Z",
+        "datePublished": "2026-11-13T09:34:26.848Z",
+        "dateUpdated": "2026-11-13T09:34:26.848Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:26.848Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/58e88fa3decf9e0145bf28a4b61a394a",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-dockerfile-path-and-build-context"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127075.json b/data/2026/127xxx/CVE-2026-127075.json
new file mode 100644
index 0000000000..50e17d48d5
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127075.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127075",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:08.127Z",
+        "datePublished": "2026-11-13T09:34:26.178Z",
+        "dateUpdated": "2026-11-13T09:34:26.178Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:26.178Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/ce44dc92c964b43008eb714343e4de82",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-additional-manifest-rendering"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127076.json b/data/2026/127xxx/CVE-2026-127076.json
new file mode 100644
index 0000000000..8f6893c370
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127076.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127076",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:08.491Z",
+        "datePublished": "2026-11-13T09:34:25.444Z",
+        "dateUpdated": "2026-11-13T09:34:25.444Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:25.444Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-broken-access-control-via-git-repo-api"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127077.json b/data/2026/127xxx/CVE-2026-127077.json
new file mode 100644
index 0000000000..e2af84b850
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127077.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127077",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:08.852Z",
+        "datePublished": "2026-11-13T09:34:24.783Z",
+        "dateUpdated": "2026-11-13T09:34:24.783Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:24.783Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/e6ba937a2ea3f06fc0a79bd6193e4574",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-environment-creation-api"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127078.json b/data/2026/127xxx/CVE-2026-127078.json
new file mode 100644
index 0000000000..daff008f93
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127078.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127078",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:09.242Z",
+        "datePublished": "2026-11-13T09:34:22.785Z",
+        "dateUpdated": "2026-11-13T09:34:22.785Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:22.785Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/26f637bfda3513ab255d8f8e46bcf8d1",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-project-env-id-parameter"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127079.json b/data/2026/127xxx/CVE-2026-127079.json
new file mode 100644
index 0000000000..def886c525
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127079.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127079",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:09.595Z",
+        "datePublished": "2026-11-13T09:34:22.100Z",
+        "dateUpdated": "2026-11-13T09:34:22.100Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:22.100Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Restriction of Excessive Authentication Attempts",
+                            "cweId": "CWE-307",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/c3c9d02c324a73937ca4db81f223435e",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-otp-brute-force-via-password-reset-check-otp"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127080.json b/data/2026/127xxx/CVE-2026-127080.json
new file mode 100644
index 0000000000..dc325b4aea
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127080.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127080",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:09.969Z",
+        "datePublished": "2026-11-13T09:34:21.479Z",
+        "dateUpdated": "2026-11-13T09:34:21.479Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:21.479Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Privilege Management",
+                            "cweId": "CWE-269",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "HIGH",
+                        "baseScore": 9.4,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 9.9,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-container-escape-via-unrestricted-hostpath-volumes"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127081.json b/data/2026/127xxx/CVE-2026-127081.json
new file mode 100644
index 0000000000..49a295375b
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127081.json
@@ -0,0 +1,129 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127081",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:12:10.282Z",
+        "datePublished": "2026-11-13T09:34:20.852Z",
+        "dateUpdated": "2026-11-13T09:34:20.852Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:20.852Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpsTree Solutions",
+                    "product": "BuildPiper",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.7.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://gist.github.com/neelkotnis/0f4aaf3d9ab99950c7f643546fd7d713",
+                    "tags": [
+                        "technical-description",
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://www.buildpiper.io/",
+                    "tags": [
+                        "product"
+                    ],
+                    "name": "BuildPiper Product Page"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-pipeline-stage-project-env-id"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Neel Saurabh Kotnis",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127082.json b/data/2026/127xxx/CVE-2026-127082.json
new file mode 100644
index 0000000000..2ab6ac64b5
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127082.json
@@ -0,0 +1,148 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127082",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:14:13.059Z",
+        "datePublished": "2026-11-13T09:34:20.176Z",
+        "dateUpdated": "2026-11-13T09:34:20.176Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:20.176Z"
+            },
+            "datePublic": "2026-11-10T20:00:39.000Z",
+            "title": "Huginn before 2026.11.09 Information Exposure via JqAgent jq env Builtin",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
+                            "cweId": "CWE-497",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "huginn",
+                    "product": "huginn",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2026.11.09",
+                            "status": "affected",
+                            "versionType": "custom"
+                        }
+                    ],
+                    "packageURL": "pkg:github/huginn/huginn",
+                    "repo": "https://github.com/huginn/huginn"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/huginn/huginn/security/advisories/GHSA-3f56-748g-q34j",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3f56-748g-q34j)"
+                },
+                {
+                    "url": "https://github.com/huginn/huginn/commit/826f4bd471c027660b1951408b44f9e5c5452aff",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jq_agent.rb#L166",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/huginn/huginn/releases/tag/v2026.11.09",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "huginn v2026.11.09 Release Notes"
+                },
+                {
+                    "name": "VulnCheck Advisory: Huginn before 2026.11.09 Information Exposure via JqAgent jq env Builtin",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/huginn-before-2026.11.09-information-exposure-via-jqagent-jq-env-builtin"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Akinori Musha",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127083.json b/data/2026/127xxx/CVE-2026-127083.json
new file mode 100644
index 0000000000..3ba2997b3b
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127083.json
@@ -0,0 +1,154 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127083",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:14:13.455Z",
+        "datePublished": "2026-11-13T09:34:19.470Z",
+        "dateUpdated": "2026-11-13T09:34:19.470Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:19.470Z"
+            },
+            "datePublic": "2026-11-10T20:00:42.000Z",
+            "title": "Huginn from 2026.09.09 before 2026.11.09 SSRF via OUTBOUND_PROXY Bypass",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Server-Side Request Forgery (SSRF)",
+                            "cweId": "CWE-918",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "huginn",
+                    "product": "huginn",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "2026.09.09",
+                            "lessThan": "2026.11.09",
+                            "status": "affected",
+                            "versionType": "custom"
+                        }
+                    ],
+                    "packageURL": "pkg:github/huginn/huginn",
+                    "repo": "https://github.com/huginn/huginn"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/huginn/huginn/security/advisories/GHSA-98rv-h5p4-9rgr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-98rv-h5p4-9rgr)"
+                },
+                {
+                    "url": "https://github.com/huginn/huginn/commit/a6f5fb64ac957f33fc6cdff6ab92884e372857a8",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/huginn/huginn/blob/v2026.11.05.2/lib/outbound_proxy.rb#L38-L42",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jira_agent.rb#L108-L109",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/huginn/huginn/releases/tag/v2026.11.09",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "huginn v2026.11.09 Release Notes"
+                },
+                {
+                    "name": "VulnCheck Advisory: Huginn from 2026.09.09 before 2026.11.09 SSRF via OUTBOUND_PROXY Bypass",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/huginn-from-2026.09.09-before-2026.11.09-ssrf-via-outbound-proxy-bypass"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Akinori Musha",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127084.json b/data/2026/127xxx/CVE-2026-127084.json
new file mode 100644
index 0000000000..102baca1db
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127084.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127084",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:14:13.578Z",
+        "datePublished": "2026-11-13T09:34:18.830Z",
+        "dateUpdated": "2026-11-13T09:34:18.830Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:18.830Z"
+            },
+            "datePublic": "2026-10-13T07:39:17.000Z",
+            "title": "Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "teableio",
+                    "product": "teable",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2026-10-12T12-45-53Z.3331",
+                            "status": "affected",
+                            "versionType": "custom"
+                        }
+                    ],
+                    "packageURL": "pkg:github/teableio/teable",
+                    "repo": "https://github.com/teableio/teable"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.5,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.3,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/teableio/teable/security/advisories/GHSA-2fm5-fcfx-hq5f",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2fm5-fcfx-hq5f)"
+                },
+                {
+                    "url": "https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Teable release.2026-10-12T12-45-53Z.3331 Release Notes"
+                },
+                {
+                    "url": "https://github.com/teableio/teable/blob/5ef2238883cad7c3980084de9a9031135fb9734f/apps/nestjs-backend/src/features/attachments/attachments.controller.ts#L52-L71",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-stored-xss-via-attachment-uploads"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "bugbunny.ai",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "0xtalon",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Luis Baronceli",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127085.json b/data/2026/127xxx/CVE-2026-127085.json
new file mode 100644
index 0000000000..d2012b77ee
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127085.json
@@ -0,0 +1,143 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127085",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:14:20.971Z",
+        "datePublished": "2026-11-13T09:34:18.133Z",
+        "dateUpdated": "2026-11-13T09:34:18.133Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:18.133Z"
+            },
+            "datePublic": "2026-11-01T05:26:17.000Z",
+            "title": "Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "IgnisDa",
+                    "product": "ryot",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "10.5.6",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:github/IgnisDa/ryot",
+                    "repo": "https://github.com/IgnisDa/ryot"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qwh4-gwr7-95x8)"
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Ryot v10.5.6 Release Notes"
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127086.json b/data/2026/127xxx/CVE-2026-127086.json
new file mode 100644
index 0000000000..5f89e36993
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127086.json
@@ -0,0 +1,143 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127086",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:14:21.333Z",
+        "datePublished": "2026-11-13T09:34:17.416Z",
+        "dateUpdated": "2026-11-13T09:34:17.416Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:17.416Z"
+            },
+            "datePublic": "2026-11-01T05:26:46.000Z",
+            "title": "Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "IgnisDa",
+                    "product": "ryot",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "10.5.6",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:github/IgnisDa/ryot",
+                    "repo": "https://github.com/IgnisDa/ryot"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-9v6w-g6x6-p4m5",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9v6w-g6x6-p4m5)"
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Ryot v10.5.6 Release Notes"
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L137-L200",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-createorupdatecollection-updateid"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127087.json b/data/2026/127xxx/CVE-2026-127087.json
new file mode 100644
index 0000000000..e875803879
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127087.json
@@ -0,0 +1,143 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127087",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:14:21.684Z",
+        "datePublished": "2026-11-13T09:34:16.780Z",
+        "dateUpdated": "2026-11-13T09:34:16.780Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:16.780Z"
+            },
+            "datePublic": "2026-11-01T05:25:58.000Z",
+            "title": "Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "IgnisDa",
+                    "product": "ryot",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "10.5.6",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:github/IgnisDa/ryot",
+                    "repo": "https://github.com/IgnisDa/ryot"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 3.1,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-9cwp-c4f6-rh6m",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9cwp-c4f6-rh6m)"
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Ryot v10.5.6 Release Notes"
+                },
+                {
+                    "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/database/src/lib.rs#L34-L45",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-revokeaccesslink-graphql-mutation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127088.json b/data/2026/127xxx/CVE-2026-127088.json
new file mode 100644
index 0000000000..9081a3b6d9
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127088.json
@@ -0,0 +1,166 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127088",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:14:22.051Z",
+        "datePublished": "2026-11-13T09:34:16.098Z",
+        "dateUpdated": "2026-11-13T09:34:16.098Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:16.098Z"
+            },
+            "datePublic": "2026-11-02T08:27:15.000Z",
+            "title": "2FAuth before 9.0.1 Password Reset Poisoning via Host Header",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Weak Password Recovery Mechanism for Forgotten Password",
+                            "cweId": "CWE-640",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Bubka",
+                    "product": "2FAuth",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "9.0.1",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:github/Bubka/2FAuth",
+                    "repo": "https://github.com/Bubka/2FAuth"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "9.0.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-v9qw-r94g-95qv)"
+                },
+                {
+                    "url": "https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Bubka/2FAuth/releases/tag/v9.0.1",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "2FAuth v9.0.1 Release Notes"
+                },
+                {
+                    "url": "https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: 2FAuth before 9.0.1 Password Reset Poisoning via Host Header",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127090.json b/data/2026/127xxx/CVE-2026-127090.json
new file mode 100644
index 0000000000..7637493273
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127090.json
@@ -0,0 +1,174 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127090",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:18:09.726Z",
+        "datePublished": "2026-11-13T09:34:15.399Z",
+        "dateUpdated": "2026-11-13T09:34:15.399Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:15.399Z"
+            },
+            "datePublic": "2026-10-01T00:00:00.000Z",
+            "title": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authentication Bypass by Primary Weakness",
+                            "cweId": "CWE-305",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Jadaptive",
+                    "product": "Maverick Synergy Server",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "3.0.33",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "3.1.0",
+                            "lessThan": "3.1.7",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:maven/com.sshtools/maverick-synergy-server",
+                    "repo": "https://github.com/sshtools/maverick-synergy"
+                },
+                {
+                    "vendor": "Jadaptive",
+                    "product": "Maverick Legacy Server",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "1.8.1",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001",
+                    "tags": [
+                        "vendor-advisory"
+                    ]
+                },
+                {
+                    "url": "https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Maverick Synergy Release Notes"
+                },
+                {
+                    "url": "https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Maverick Legacy Server Release Notes"
+                },
+                {
+                    "url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Jadaptive Limited",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127091.json b/data/2026/127xxx/CVE-2026-127091.json
new file mode 100644
index 0000000000..915ce41924
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127091.json
@@ -0,0 +1,168 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127091",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:18:16.983Z",
+        "datePublished": "2026-11-13T09:34:14.761Z",
+        "dateUpdated": "2026-11-13T09:34:14.761Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:14.761Z"
+            },
+            "datePublic": "2026-10-01T00:00:00.000Z",
+            "title": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Resolution of Path Equivalence",
+                            "cweId": "CWE-41",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Jadaptive",
+                    "product": "Maverick Synergy Server",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "3.0.33",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "3.1.0",
+                            "lessThan": "3.1.7",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:maven/com.sshtools/maverick-virtual-filesystem",
+                    "repo": "https://github.com/sshtools/maverick-synergy"
+                },
+                {
+                    "vendor": "Jadaptive",
+                    "product": "Maverick Legacy Server",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "1.8.1",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-002",
+                    "tags": [
+                        "vendor-advisory"
+                    ]
+                },
+                {
+                    "url": "https://github.com/sshtools/maverick-synergy/commit/f5531c21302d00901021bf2cb4dba7fca6436cfb",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Maverick Synergy Release Notes"
+                },
+                {
+                    "url": "https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Maverick Legacy Server Release Notes"
+                },
+                {
+                    "url": "https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-virtual-filesystem/src/main/java/com/sshtools/common/files/vfs/VirtualFileFactory.java#L189-L219",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-vfs-mount-policy-bypass-via-non-canonical-paths"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Jadaptive Limited",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127092.json b/data/2026/127xxx/CVE-2026-127092.json
new file mode 100644
index 0000000000..7475875241
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127092.json
@@ -0,0 +1,141 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127092",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:18:17.360Z",
+        "datePublished": "2026-11-13T09:34:14.088Z",
+        "dateUpdated": "2026-11-13T09:34:14.088Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:14.088Z"
+            },
+            "datePublic": "2026-11-12T04:42:34.000Z",
+            "title": "BuildAdmin 1.0.1 through 2.3.9 Stored XSS via X-Rewrite-URL in Admin Log",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "build-admin",
+                    "product": "BuildAdmin",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "1.0.1",
+                            "lessThanOrEqual": "2.3.9",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:github/build-admin/BuildAdmin",
+                    "repo": "https://github.com/build-admin/BuildAdmin"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/build-admin/BuildAdmin/issues/70",
+                    "tags": [
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "url": "https://vul.yulun.ac.cn/20261112/buildadmin/",
+                    "tags": [
+                        "third-party-advisory"
+                    ]
+                },
+                {
+                    "url": "https://github.com/build-admin/BuildAdmin/blob/v2.3.9/app/admin/model/AdminLog.php#L145-L153",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/build-admin/BuildAdmin/blob/v2.3.9/web/src/components/table/fieldRender/url.vue#L32-L38",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: BuildAdmin 1.0.1 through 2.3.9 Stored XSS via X-Rewrite-URL in Admin Log",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/buildadmin-1.0.1-through-2.3.9-stored-xss-via-x-rewrite-url-in-admin-log"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Wu Yulun",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127093.json b/data/2026/127xxx/CVE-2026-127093.json
new file mode 100644
index 0000000000..da2237dd10
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127093.json
@@ -0,0 +1,155 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127093",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:18:17.723Z",
+        "datePublished": "2026-11-13T09:34:13.400Z",
+        "dateUpdated": "2026-11-13T09:34:13.400Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:13.400Z"
+            },
+            "datePublic": "2026-11-04T18:49:11.000Z",
+            "title": "Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Server-Side Request Forgery (SSRF)",
+                            "cweId": "CWE-918",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "rustrak",
+                    "product": "rustrak",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "0.26.0",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "packageURL": "pkg:github/rustrak/rustrak",
+                    "repo": "https://github.com/rustrak/rustrak"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/rustrak/rustrak/issues/504",
+                    "tags": [
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "url": "https://github.com/rustrak/rustrak/pull/525",
+                    "tags": [
+                        "patch",
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "url": "https://github.com/rustrak/rustrak/commit/f41c464ec56954b1876062d70aef920e786ca40b",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/rustrak/rustrak/releases/tag/v0.26.0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Rustrak v0.26.0 Release Notes"
+                },
+                {
+                    "url": "https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/services/notification/webhook.rs#L161-L250",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/routes/alerts.rs#L422-L479",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/rustrak-before-0.26.0-ssrf-via-alert-integration-test-routing-override-url"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "George Chen",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127094.json b/data/2026/127xxx/CVE-2026-127094.json
new file mode 100644
index 0000000000..5ce1aae155
--- /dev/null
+++ b/data/2026/127xxx/CVE-2026-127094.json
@@ -0,0 +1,135 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-127094",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T14:27:04.667Z",
+        "datePublished": "2026-11-13T09:34:12.707Z",
+        "dateUpdated": "2026-11-13T09:34:12.707Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:12.707Z"
+            },
+            "datePublic": "2026-10-01T00:00:00.000Z",
+            "title": "Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authorization",
+                            "cweId": "CWE-862",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Pagelayer Team",
+                    "product": "Pagelayer",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "2.1.7",
+                            "lessThan": "2.2.1",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "collectionURL": "https://wordpress.org/plugins",
+                    "repo": "https://plugins.svn.wordpress.org/pagelayer/"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7.6,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://wpsec.com/vuln/WPSEC-2026-0215",
+                    "tags": [
+                        "third-party-advisory"
+                    ]
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3698421/pagelayer",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://plugins.svn.wordpress.org/pagelayer/tags/2.1.9/main/abilitiesregister.php",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/pagelayer-2.1.7-before-2.2.1-missing-authorization-via-abilities-api"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Paul Serban (LazyTitan)",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128014.json b/data/2026/128xxx/CVE-2026-128014.json
new file mode 100644
index 0000000000..ad4f7f1cfa
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128014.json
@@ -0,0 +1,146 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128014",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.531Z",
+        "datePublished": "2026-11-13T09:34:12.011Z",
+        "dateUpdated": "2026-11-13T09:34:12.011Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:12.011Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Out-of-bounds Write",
+                            "cweId": "CWE-787",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "1.8.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.2"
+                        },
+                        {
+                            "version": "1.13.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "1.8.0",
+                                    "versionEndExcluding": "1.13.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-p746-jj3f-94p8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-p746-jj3f-94p8)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-1.8.0-before-1.13.2-out-of-bounds-write-via-bundled-brotli-decoder"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "pilvar222",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128015.json b/data/2026/128xxx/CVE-2026-128015.json
new file mode 100644
index 0000000000..4ff413c298
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128015.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128015",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.531Z",
+        "datePublished": "2026-11-13T09:34:11.325Z",
+        "dateUpdated": "2026-11-13T09:34:11.325Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:11.325Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Use After Free",
+                            "cweId": "CWE-416",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.4"
+                        },
+                        {
+                            "version": "1.13.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-rgpj-f2qx-xwhf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rgpj-f2qx-xwhf)"
+                },
+                {
+                    "url": "https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-via-putenv-during-request-shutdown"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "atarus-security",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128016.json b/data/2026/128xxx/CVE-2026-128016.json
new file mode 100644
index 0000000000..59a14a1a72
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128016.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128016",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:10.667Z",
+        "dateUpdated": "2026-11-13T09:34:10.667Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:10.667Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Use After Free",
+                            "cweId": "CWE-416",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.4"
+                        },
+                        {
+                            "version": "1.13.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-cm3q-jw2q-9rh5",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-cm3q-jw2q-9rh5)"
+                },
+                {
+                    "url": "https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-of-spltempfileobject-streams-in-worker-mode"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "atarus-security",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128017.json b/data/2026/128xxx/CVE-2026-128017.json
new file mode 100644
index 0000000000..9edc8b1659
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128017.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128017",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:09.979Z",
+        "dateUpdated": "2026-11-13T09:34:09.979Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:09.979Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Double Free",
+                            "cweId": "CWE-415",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.4"
+                        },
+                        {
+                            "version": "1.13.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-h764-4wh7-m7j2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-h764-4wh7-m7j2)"
+                },
+                {
+                    "url": "https://github.com/php/frankenphp/commit/8777cc2e5c872ebb869fa2b5f972a913648621e8",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-double-free-in-worker-mode-via-non-form-post"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "atarus-security",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128018.json b/data/2026/128xxx/CVE-2026-128018.json
new file mode 100644
index 0000000000..154b6ea843
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128018.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128018",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:09.269Z",
+        "dateUpdated": "2026-11-13T09:34:09.269Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:09.269Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.4 Pending Worker Request Denial of Service",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() returns false without finishing the dequeued request after a fatal error during request startup. Attackers who trigger startup fatal errors against worker scripts that keep calling frankenphp_handle_request() can leave client requests hanging indefinitely while the worker continues running."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Resource Shutdown or Release",
+                            "cweId": "CWE-404",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.4"
+                        },
+                        {
+                            "version": "1.13.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-x6j6-qv7w-fq3c",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-x6j6-qv7w-fq3c)"
+                },
+                {
+                    "url": "https://github.com/php/frankenphp/commit/185bfe578af854d29d7bdff3dd83b3b9dea3572b",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.4 Pending Worker Request Denial of Service",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-pending-worker-request-denial-of-service"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "inanna-malick",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128019.json b/data/2026/128xxx/CVE-2026-128019.json
new file mode 100644
index 0000000000..ad231e4af6
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128019.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128019",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:08.571Z",
+        "dateUpdated": "2026-11-13T09:34:08.571Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:08.571Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.4"
+                        },
+                        {
+                            "version": "1.13.4",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.4"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-8386-64gm-3m8q",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-8386-64gm-3m8q)"
+                },
+                {
+                    "url": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-information-disclosure-via-per-request-environment-variable-leak"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "inanna-malick",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128020.json b/data/2026/128xxx/CVE-2026-128020.json
new file mode 100644
index 0000000000..5d8268c94e
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128020.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128020",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:07.894Z",
+        "dateUpdated": "2026-11-13T09:34:07.894Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:07.894Z"
+            },
+            "datePublic": "2026-10-21T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Recursion",
+                            "cweId": "CWE-674",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.2"
+                        },
+                        {
+                            "version": "1.13.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-ccgp-ch9h-533f",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-ccgp-ch9h-533f)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-cyclic-array-conversion"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Reload3d",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128021.json b/data/2026/128xxx/CVE-2026-128021.json
new file mode 100644
index 0000000000..c4ca086348
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128021.json
@@ -0,0 +1,150 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128021",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:07.192Z",
+        "dateUpdated": "2026-11-13T09:34:07.192Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:07.192Z"
+            },
+            "datePublic": "2026-10-21T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.2"
+                        },
+                        {
+                            "version": "1.13.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-4gfw-9v29-gp9h",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4gfw-9v29-gp9h)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-information-disclosure-via-libxml-error-state-in-worker-mode"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "manus-use",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "alexandre-daubois",
+                    "type": "analyst"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128022.json b/data/2026/128xxx/CVE-2026-128022.json
new file mode 100644
index 0000000000..c2f7867eb8
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128022.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128022",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:06.526Z",
+        "dateUpdated": "2026-11-13T09:34:06.526Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:06.526Z"
+            },
+            "datePublic": "2026-10-21T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Resource Consumption",
+                            "cweId": "CWE-400",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.2"
+                        },
+                        {
+                            "version": "1.13.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-fq24-r53r-xcx3",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fq24-r53r-xcx3)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-queued-disconnected-requests"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "alexandre-daubois",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128023.json b/data/2026/128xxx/CVE-2026-128023.json
new file mode 100644
index 0000000000..953a55e3e8
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128023.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128023",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:32:53.532Z",
+        "datePublished": "2026-11-13T09:34:05.836Z",
+        "dateUpdated": "2026-11-13T09:34:05.836Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:05.836Z"
+            },
+            "datePublic": "2026-10-04T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authentication Bypass by Spoofing",
+                            "cweId": "CWE-290",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.0"
+                        },
+                        {
+                            "version": "1.13.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-qcrp-8483-f2f2",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qcrp-8483-f2f2)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-authentication-bypass-via-dot-form-header-name-aliasing"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "tikipiya",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128024.json b/data/2026/128xxx/CVE-2026-128024.json
new file mode 100644
index 0000000000..8fc46a4226
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128024.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128024",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.124Z",
+        "datePublished": "2026-11-13T09:34:05.162Z",
+        "dateUpdated": "2026-11-13T09:34:05.162Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:05.162Z"
+            },
+            "datePublic": "2026-10-04T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncaught Exception",
+                            "cweId": "CWE-248",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.0"
+                        },
+                        {
+                            "version": "1.13.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-4prg-hv4r-g6mv",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4prg-hv4r-g6mv)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-denial-of-service-via-goarray-nil-type-assertion"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "bipol4r",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128025.json b/data/2026/128xxx/CVE-2026-128025.json
new file mode 100644
index 0000000000..6c96ebb84a
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128025.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128025",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:34:04.485Z",
+        "dateUpdated": "2026-11-13T09:34:04.485Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:04.485Z"
+            },
+            "datePublic": "2026-10-04T00:00:00.000Z",
+            "title": "FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute uploads/a.php despite route-level or WAF deny rules and forge PATH_INFO, SCRIPT_NAME, and PHP_SELF values."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Interpretation Conflict",
+                            "cweId": "CWE-436",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.0"
+                        },
+                        {
+                            "version": "1.13.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.13.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-xxjp-cjxr-2x6m",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-xxjp-cjxr-2x6m)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-cgi-path-split-boundary-bypass-via-splitpos"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Reload3d",
+                    "type": "reporter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128026.json b/data/2026/128xxx/CVE-2026-128026.json
new file mode 100644
index 0000000000..d6ca306aa2
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128026.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128026",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:34:03.804Z",
+        "dateUpdated": "2026-11-13T09:34:03.804Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:03.804Z"
+            },
+            "datePublic": "2026-10-04T00:00:00.000Z",
+            "title": "FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc_open or exec can read secrets such as database passwords set by other requests."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Data Element to Wrong Session",
+                            "cweId": "CWE-488",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:golang/github.com/dunglas/frankenphp",
+                    "versions": [
+                        {
+                            "version": "1.5.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.13.0"
+                        },
+                        {
+                            "version": "1.13.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "1.5.0",
+                                    "versionEndExcluding": "1.13.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-996f-w38m-f574",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-996f-w38m-f574)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-1.5.0-before-1.13.0-cross-request-environment-leakage-via-putenv"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "iliaal",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "alexandre-daubois",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128027.json b/data/2026/128xxx/CVE-2026-128027.json
new file mode 100644
index 0000000000..d1760fb182
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128027.json
@@ -0,0 +1,149 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128027",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:34:03.119Z",
+        "dateUpdated": "2026-11-13T09:34:03.119Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:03.119Z"
+            },
+            "datePublic": "2026-02-05T00:00:00.000Z",
+            "title": "FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Dependency on Vulnerable Third-Party Component",
+                            "cweId": "CWE-1395",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "php",
+                    "product": "frankenphp",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "1.1.11"
+                        },
+                        {
+                            "version": "1.1.11",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "1.1.11"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.3,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 9.8,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/php/frankenphp/security/advisories/GHSA-x9p2-77v6-6vhf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-x9p2-77v6-6vhf)"
+                },
+                {
+                    "name": "VulnCheck Advisory: FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/frankenphp-before-1.1.11-delayed-propagation-of-base-image-security-fixes"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "opctim",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "dunglas",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128028.json b/data/2026/128xxx/CVE-2026-128028.json
new file mode 100644
index 0000000000..2d19c1386a
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128028.json
@@ -0,0 +1,166 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128028",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:34:02.436Z",
+        "dateUpdated": "2026-11-13T09:34:02.436Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:02.436Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.7,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-v7mx-rv47-452m",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-v7mx-rv47-452m)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/5896b2a60b10e892cec594391b2612ab53a4ce59",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-custom-option-svg-upload"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128029.json b/data/2026/128xxx/CVE-2026-128029.json
new file mode 100644
index 0000000000..7f0d3e7b72
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128029.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128029",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:34:01.768Z",
+        "dateUpdated": "2026-11-13T09:34:01.768Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:01.768Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.7,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-28hq-mq6h-fh2x)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128030.json b/data/2026/128xxx/CVE-2026-128030.json
new file mode 100644
index 0000000000..a829885276
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128030.json
@@ -0,0 +1,159 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128030",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:34:01.082Z",
+        "dateUpdated": "2026-11-13T09:34:01.082Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:01.082Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Insufficient Session Expiration After API User Deactivation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficient Session Expiration",
+                            "cweId": "CWE-613",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rrhg-c635-fmrm",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rrhg-c635-fmrm)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/73048b7d8380fefb423869342c708ac30f80bc4b",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/9daf2c647759816ade7be2c906f08f56cb43a864",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Insufficient Session Expiration After API User Deactivation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-insufficient-session-expiration-after-api-user-deactivation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128031.json b/data/2026/128xxx/CVE-2026-128031.json
new file mode 100644
index 0000000000..b32c9497f0
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128031.json
@@ -0,0 +1,159 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128031",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:34:00.400Z",
+        "dateUpdated": "2026-11-13T09:34:00.400Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:34:00.400Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.8,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-wgf8-gh63-gfqf",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wgf8-gh63-gfqf)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/37fa46699ea0d3c4301994dc9411b5639b2ffc2f",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/b36d00df844ad127b24b481e1d4c2df90b75d559",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-incorrect-authorization-in-admin-controllers-acl"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128032.json b/data/2026/128xxx/CVE-2026-128032.json
new file mode 100644
index 0000000000..bfe2287491
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128032.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128032",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:33:59.721Z",
+        "dateUpdated": "2026-11-13T09:33:59.721Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:59.721Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Enforcement of Behavioral Workflow",
+                            "cweId": "CWE-841",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-rmw8-7h79-p386)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "hariprasanth9317-tech",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128033.json b/data/2026/128xxx/CVE-2026-128033.json
new file mode 100644
index 0000000000..34dd7beb1b
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128033.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128033",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:33:43.125Z",
+        "datePublished": "2026-11-13T09:33:59.025Z",
+        "dateUpdated": "2026-11-13T09:33:59.025Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:59.025Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Exposure of Sensitive Information to an Unauthorized Actor",
+                            "cweId": "CWE-200",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-wmwx-442r-jc88",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wmwx-442r-jc88)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/2b7795664d55aadc43cc74e1527ab5b046ff7a8a",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-information-disclosure-via-order-status-rss-feed"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128040.json b/data/2026/128xxx/CVE-2026-128040.json
new file mode 100644
index 0000000000..91a789445c
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128040.json
@@ -0,0 +1,183 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128040",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:58.324Z",
+        "dateUpdated": "2026-11-13T09:33:58.324Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:58.324Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Stored XSS via Admin Dataflow, Tax, OAuth, PayPal Fields",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.4,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m858-x59w-rmp5",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-m858-x59w-rmp5)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/7f7a9deaac11fd2437bb1f8065db152a4b620609",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/62d2885fa6e7a4454e3a5c7765a6a5ca0085ecc1",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/e97e257b8f8d74d2e52dbf28caa211c262ff26be",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Stored XSS via Admin Dataflow, Tax, OAuth, PayPal Fields",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-admin-dataflow-tax-oauth-paypal-fields"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "UltraRamy",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128041.json b/data/2026/128xxx/CVE-2026-128041.json
new file mode 100644
index 0000000000..4610a5f7bf
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128041.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128041",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:57.636Z",
+        "dateUpdated": "2026-11-13T09:33:57.636Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:57.636Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.8,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 8,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-j9c5-pcvx-jx9x",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-j9c5-pcvx-jx9x)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/34e88f5447dff22e4ddc8cb0952d934ac3fdd15b",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-rss-review-feed"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128042.json b/data/2026/128xxx/CVE-2026-128042.json
new file mode 100644
index 0000000000..2c78038580
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128042.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128042",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:56.952Z",
+        "dateUpdated": "2026-11-13T09:33:56.952Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:56.952Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.19.0 Race Condition in Coupon Usage Limits",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
+                            "cweId": "CWE-362",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.19.0"
+                        },
+                        {
+                            "version": "20.19.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5rg7-22cv-c9q6",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-5rg7-22cv-c9q6)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/2626f027a752cda004c5cf7f8f9bd3cf52f525f2",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.19.0 Race Condition in Coupon Usage Limits",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-race-condition-in-coupon-usage-limits"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "skeletonsec",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128043.json b/data/2026/128xxx/CVE-2026-128043.json
new file mode 100644
index 0000000000..187184495f
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128043.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128043",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:56.263Z",
+        "dateUpdated": "2026-11-13T09:33:56.263Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:56.263Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return Handlers",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Cross-Site Request Forgery (CSRF)",
+                            "cweId": "CWE-352",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.19.0"
+                        },
+                        {
+                            "version": "20.19.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.1,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-2jfg-wx75-5cc8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-2jfg-wx75-5cc8)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/86c8895d586db61ac7d093ba4e473103a30882c8",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return Handlers",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-csrf-via-paypal-cancel-return-handlers"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "skeletonsec",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128044.json b/data/2026/128xxx/CVE-2026-128044.json
new file mode 100644
index 0000000000..f4e97d687f
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128044.json
@@ -0,0 +1,162 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128044",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:55.592Z",
+        "dateUpdated": "2026-11-13T09:33:55.592Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:55.592Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Origin Validation Error",
+                            "cweId": "CWE-346",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-mffc-h5pf-6f42",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mffc-h5pf-6f42)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/d03a00b60e4a2d4e5a00b44dbc66d25bc3b3fc8f",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-oauth-callback-url-allowlist-bypass"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "skeletonsec",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128045.json b/data/2026/128xxx/CVE-2026-128045.json
new file mode 100644
index 0000000000..c704a32b94
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128045.json
@@ -0,0 +1,162 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128045",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:54.917Z",
+        "dateUpdated": "2026-11-13T09:33:54.917Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:54.917Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Authorization Bypass Through User-Controlled Key",
+                            "cweId": "CWE-639",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3hh8-xg45-mwrr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3hh8-xg45-mwrr)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/fde2d109292944d705c4035d87df055b1e945ea3",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-authorization-bypass-via-forgeable-rss-order-key"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "bruhdev1290",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128046.json b/data/2026/128xxx/CVE-2026-128046.json
new file mode 100644
index 0000000000..d2c8e46a31
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128046.json
@@ -0,0 +1,181 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128046",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:54.254Z",
+        "dateUpdated": "2026-11-13T09:33:54.254Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:54.254Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incomplete List of Disallowed Inputs",
+                            "cweId": "CWE-184",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "20.17.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-4fxg-469f-r6fc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-4fxg-469f-r6fc)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/ba76b2346fe1e380f39c23e68ccb818d7324d24f",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-20.17.0-before-20.18.2-unrestricted-file-upload-rce-via-custom-options"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "arpitjain099",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "4n86rakam1",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128047.json b/data/2026/128xxx/CVE-2026-128047.json
new file mode 100644
index 0000000000..adb1efa1dd
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128047.json
@@ -0,0 +1,179 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128047",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:53.555Z",
+        "dateUpdated": "2026-11-13T09:33:53.555Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:53.555Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Use of Insufficiently Random Values",
+                            "cweId": "CWE-330",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-7j66-6mw7-rgfx",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-7j66-6mw7-rgfx)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/4a8d91c692524de4a07e70af5367b6cb67a9516d",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/9f5a1c3cf63f5cf6ac9f90b041a97a474cea04c2",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-account-takeover-via-predictable-confirmation-key"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "alimony",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "Abhi-Hackz",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "hariprasanth9317-tech",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "philipsorensen",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128048.json b/data/2026/128xxx/CVE-2026-128048.json
new file mode 100644
index 0000000000..81ecd6a299
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128048.json
@@ -0,0 +1,162 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128048",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.416Z",
+        "datePublished": "2026-11-13T09:33:52.864Z",
+        "dateUpdated": "2026-11-13T09:33:52.864Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:52.864Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Handling of Case Sensitivity",
+                            "cweId": "CWE-178",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-94p5-6j66-c9j6",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-94p5-6j66-c9j6)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/6763d33dfdb7fb33704ad095eb8e4d5a20e30f75",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-information-disclosure-via-email-template-getconfig"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "C-Brown",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128049.json b/data/2026/128xxx/CVE-2026-128049.json
new file mode 100644
index 0000000000..42ab45ff37
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128049.json
@@ -0,0 +1,172 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128049",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:45:47.417Z",
+        "datePublished": "2026-11-13T09:33:52.073Z",
+        "dateUpdated": "2026-11-13T09:33:52.073Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:52.073Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Cross-Site Request Forgery (CSRF)",
+                            "cweId": "CWE-352",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "HIGH",
+                        "subAvailabilityImpact": "HIGH",
+                        "baseScore": 9.4,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 9,
+                        "baseSeverity": "CRITICAL"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-grrq-9gq2-vm55",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-grrq-9gq2-vm55)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/1f83e49b60e08aa7ba89dcc2d41ea21f62c0b796",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-csrf-via-oauth-authorization-confirm"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "C-Brown",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "Abhi-Hackz",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "theroch",
+                    "type": "remediation reviewer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128051.json b/data/2026/128xxx/CVE-2026-128051.json
new file mode 100644
index 0000000000..6ff7857319
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128051.json
@@ -0,0 +1,169 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128051",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:46:46.662Z",
+        "datePublished": "2026-11-13T09:33:51.362Z",
+        "dateUpdated": "2026-11-13T09:33:51.362Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:51.362Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Stored XSS via Product Name in MSRP Popup",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.5,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hfqq-c3qm-38x8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-hfqq-c3qm-38x8)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/64ff7fce3db72cad83e41131bdf48c42ba2ad2f2",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/2437b01af99279aa1c6ca5c19f919449b38a5a66",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Stored XSS via Product Name in MSRP Popup",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-name-in-msrp-popup"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "v3rticalmoney",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                },
+                {
+                    "lang": "en",
+                    "value": "Hanmac",
+                    "type": "remediation reviewer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128052.json b/data/2026/128xxx/CVE-2026-128052.json
new file mode 100644
index 0000000000..b62917c961
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128052.json
@@ -0,0 +1,157 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128052",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:46:46.662Z",
+        "datePublished": "2026-11-13T09:33:50.608Z",
+        "dateUpdated": "2026-11-13T09:33:50.608Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:50.608Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incorrect Authorization",
+                            "cweId": "CWE-863",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.19.0"
+                        },
+                        {
+                            "version": "20.19.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 2.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fqq6-76qg-2r96",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-fqq6-76qg-2r96)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/055ccb866c0fadfed2c27e8c0e9ebd10db0199df",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-block-whitelist-bypass-via-layout-directive"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "0x0OZ",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128053.json b/data/2026/128xxx/CVE-2026-128053.json
new file mode 100644
index 0000000000..196add0f14
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128053.json
@@ -0,0 +1,162 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128053",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T20:46:46.663Z",
+        "datePublished": "2026-11-13T09:33:49.875Z",
+        "dateUpdated": "2026-11-13T09:33:49.875Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:49.875Z"
+            },
+            "datePublic": "2026-10-26T00:00:00.000Z",
+            "title": "OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "20.18.2"
+                        },
+                        {
+                            "version": "20.18.2",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "OpenMage",
+                    "product": "magento-lts",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "21.0.0-beta1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "21.0.0-beta3"
+                        },
+                        {
+                            "version": "21.0.0-beta3",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "LOW",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.7,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6pvw-8mv9-r8vr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-6pvw-8mv9-r8vr)"
+                },
+                {
+                    "url": "https://github.com/OpenMage/magento-lts/commit/0bcec215c25941f900d46657d63fd0862960edf6",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Patch Commit"
+                },
+                {
+                    "name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-reflected-xss-via-error-pages-script-name"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "justlife4x4",
+                    "type": "coordinator"
+                },
+                {
+                    "lang": "en",
+                    "value": "0xElkot",
+                    "type": "reporter"
+                },
+                {
+                    "lang": "en",
+                    "value": "colinmollenhour",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128237.json b/data/2026/128xxx/CVE-2026-128237.json
new file mode 100644
index 0000000000..2a5d7e69fe
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128237.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128237",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T23:11:45.421Z",
+        "datePublished": "2026-11-13T09:33:49.101Z",
+        "dateUpdated": "2026-11-13T09:33:49.101Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:49.101Z"
+            },
+            "datePublic": "2026-09-08T00:00:00.000Z",
+            "title": "Scapy before 2.8.0 Denial of Service via Quadratic BER OID Decoding",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Inefficient Algorithmic Complexity",
+                            "cweId": "CWE-407",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "secdev",
+                    "product": "scapy",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/Scapy",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.8.0"
+                        },
+                        {
+                            "version": "2.8.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:scapy:scapy:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.8.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/secdev/scapy/security/advisories/GHSA-xx44-g48m-mjp6",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-xx44-g48m-mjp6)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Scapy before 2.8.0 Denial of Service via Quadratic BER OID Decoding",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/scapy-before-2.8.0-denial-of-service-via-quadratic-ber-oid-decoding"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "tynus2",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128238.json b/data/2026/128xxx/CVE-2026-128238.json
new file mode 100644
index 0000000000..82db287b4c
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128238.json
@@ -0,0 +1,145 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128238",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T23:11:45.421Z",
+        "datePublished": "2026-11-13T09:33:48.401Z",
+        "dateUpdated": "2026-11-13T09:33:48.401Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:48.401Z"
+            },
+            "datePublic": "2026-09-08T00:00:00.000Z",
+            "title": "Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Uncontrolled Recursion",
+                            "cweId": "CWE-674",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "secdev",
+                    "product": "scapy",
+                    "defaultStatus": "unaffected",
+                    "packageURL": "pkg:pypi/scapy",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.8.0"
+                        },
+                        {
+                            "version": "2.8.0",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:scapy:scapy:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.8.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/secdev/scapy/security/advisories/GHSA-456h-w4v7-hvpr",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-456h-w4v7-hvpr)"
+                },
+                {
+                    "name": "VulnCheck Advisory: Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/scapy-before-2.8.0-uncontrolled-recursion-dos-via-ber-sequence-decoder"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "infycore",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128239.json b/data/2026/128xxx/CVE-2026-128239.json
new file mode 100644
index 0000000000..cae5ebd69f
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128239.json
@@ -0,0 +1,168 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128239",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T23:11:45.421Z",
+        "datePublished": "2026-11-13T09:33:47.579Z",
+        "dateUpdated": "2026-11-13T09:33:47.579Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:47.579Z"
+            },
+            "datePublic": "2026-10-29T21:27:34.000Z",
+            "title": "GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "NULL Pointer Dereference",
+                            "cweId": "CWE-476",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "gpac",
+                    "product": "gpac",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "26.07.0"
+                        }
+                    ],
+                    "packageURL": "pkg:github/gpac/gpac"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "26.07.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/gpac/gpac/issues/4029",
+                    "tags": [
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "url": "https://github.com/gpac/gpac/commit/bc416b997622e43de65afab3bae9b7d05d72f2b0",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/mpeg4_form.c#L620-L621",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/221/221_ab_apply_compositor_mpeg4_form_c_627.xmt",
+                    "tags": [
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://github.com/gpac/gpac",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/gpac-through-26.07.0-null-pointer-dereference-via-mpeg-4-form-handlers"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Alexander A. Shvedov (sigdevel)",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Jean Le Feuvre",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128240.json b/data/2026/128xxx/CVE-2026-128240.json
new file mode 100644
index 0000000000..596c3826f0
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128240.json
@@ -0,0 +1,174 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128240",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T23:11:45.421Z",
+        "datePublished": "2026-11-13T09:33:46.903Z",
+        "dateUpdated": "2026-11-13T09:33:46.903Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:46.903Z"
+            },
+            "datePublic": "2026-10-29T21:52:49.000Z",
+            "title": "GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Use After Free",
+                            "cweId": "CWE-416",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "gpac",
+                    "product": "gpac",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "custom",
+                            "lessThanOrEqual": "26.07.0"
+                        }
+                    ],
+                    "packageURL": "pkg:github/gpac/gpac"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "26.07.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/gpac/gpac/issues/4031",
+                    "tags": [
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "url": "https://github.com/gpac/gpac/commit/a2e5c62c213b5329a4572fe8e7c333e1ca26d028",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/vrml_proto.c#L103-L111",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/base_scenegraph.c#L537-L542",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/223/223_gf_sg_proto_del_scenegraph_vrml_proto_c.xmt",
+                    "tags": [
+                        "exploit"
+                    ]
+                },
+                {
+                    "url": "https://github.com/gpac/gpac",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/gpac-through-26.07.0-use-after-free-in-gf-sg-proto-del-during-scene-teardown"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Alexander A. Shvedov (sigdevel)",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Jean Le Feuvre",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128241.json b/data/2026/128xxx/CVE-2026-128241.json
new file mode 100644
index 0000000000..bd550e0c72
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128241.json
@@ -0,0 +1,163 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128241",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T23:11:45.421Z",
+        "datePublished": "2026-11-13T09:33:46.216Z",
+        "dateUpdated": "2026-11-13T09:33:46.216Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:46.216Z"
+            },
+            "datePublic": "2026-11-12T11:15:35.000Z",
+            "title": "libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen(\"wb\"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Link Resolution Before File Access ('Link Following')",
+                            "cweId": "CWE-59",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "libexpat project",
+                    "product": "libexpat",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "2.10.0"
+                        }
+                    ],
+                    "packageURL": "pkg:github/libexpat/libexpat"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "2.10.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 4.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
+                        "attackVector": "LOCAL",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/libexpat/libexpat/pull/1502",
+                    "tags": [
+                        "patch",
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "url": "https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/xmlwf/xmlwf.c#L1272-L1275",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/xmlwf/xmlwf.c#L1338-L1347",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/libexpat/libexpat",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/libexpat-xmlwf-through-2.10.0-symlink-following-via-d-output-directory"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Aziz Elbelaychy",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Sebastian Pipping",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128242.json b/data/2026/128xxx/CVE-2026-128242.json
new file mode 100644
index 0000000000..62eb10660a
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128242.json
@@ -0,0 +1,223 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128242",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-12T23:11:45.421Z",
+        "datePublished": "2026-11-13T09:33:45.553Z",
+        "dateUpdated": "2026-11-13T09:33:45.553Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:45.553Z"
+            },
+            "datePublic": "2026-11-06T12:17:07.000Z",
+            "title": "actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Handling of Highly Compressed Data (Data Amplification)",
+                            "cweId": "CWE-409",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "actix",
+                    "product": "actix-http",
+                    "packageURL": "pkg:cargo/actix-http",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "3.20.1",
+                            "status": "affected",
+                            "versionType": "semver"
+                        }
+                    ]
+                },
+                {
+                    "vendor": "actix",
+                    "product": "actix-web",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "4.18.2"
+                        }
+                    ],
+                    "packageURL": "pkg:cargo/actix-web"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:actix:actix-http:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "3.20.1"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:actix:actix-web:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "4.18.2"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qph8-7859-gq2f)"
+                },
+                {
+                    "url": "https://rustsec.org/advisories/RUSTSEC-2026-0448.html",
+                    "tags": [
+                        "third-party-advisory"
+                    ]
+                },
+                {
+                    "url": "https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "actix-web actix-http-v3.20.1 Release Notes"
+                },
+                {
+                    "url": "https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "actix-web actix-web-v4.18.2 Release Notes"
+                },
+                {
+                    "url": "https://github.com/actix/actix-web",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Stapat",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "diandiandia",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "lboynton",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "calbebop",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Rob Ede",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128328.json b/data/2026/128xxx/CVE-2026-128328.json
new file mode 100644
index 0000000000..a50f7713b0
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128328.json
@@ -0,0 +1,178 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128328",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:35.660Z",
+        "datePublished": "2026-11-13T09:33:44.878Z",
+        "dateUpdated": "2026-11-13T09:33:44.878Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:44.878Z"
+            },
+            "datePublic": "2026-11-12T08:14:53.000Z",
+            "title": "Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Dokploy",
+                    "product": "dokploy",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0.28.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.31.1"
+                        }
+                    ],
+                    "packageURL": "pkg:github/Dokploy/dokploy"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.28.0",
+                                    "versionEndExcluding": "0.31.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "LOW",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-q7cq-vxv7-449c)"
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/pull/5899",
+                    "tags": [
+                        "issue-tracking",
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/releases/tag/v0.31.1",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "dokploy v0.31.1 Release Notes"
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/apps/dokploy/server/api/routers/patch.ts#L181-L202",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L84-L90",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Mauricio Siu",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128329.json b/data/2026/128xxx/CVE-2026-128329.json
new file mode 100644
index 0000000000..90990ce540
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128329.json
@@ -0,0 +1,198 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128329",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:36.016Z",
+        "datePublished": "2026-11-13T09:33:44.203Z",
+        "dateUpdated": "2026-11-13T09:33:44.203Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:44.203Z"
+            },
+            "datePublic": "2026-11-12T08:16:46.000Z",
+            "title": "Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                            "cweId": "CWE-22",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Dokploy",
+                    "product": "dokploy",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0.28.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "0.31.1"
+                        }
+                    ],
+                    "packageURL": "pkg:github/Dokploy/dokploy"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "0.28.0",
+                                    "versionEndExcluding": "0.31.1"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "HIGH",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "CHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-g6rj-m32j-2mc4",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-g6rj-m32j-2mc4)"
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/pull/5899",
+                    "tags": [
+                        "issue-tracking",
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/releases/tag/v0.31.1",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "dokploy v0.31.1 Release Notes"
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/commit/40e818b0e0d8e448e7a30c559ebf4e146e5932ae",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L148-L181",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepofile"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "sondt99",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "nlgbao1340",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "lml20000827",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "farisv",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Mauricio Siu",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128330.json b/data/2026/128xxx/CVE-2026-128330.json
new file mode 100644
index 0000000000..02a5f4624e
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128330.json
@@ -0,0 +1,171 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128330",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:36.385Z",
+        "datePublished": "2026-11-13T09:33:43.522Z",
+        "dateUpdated": "2026-11-13T09:33:43.522Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:43.522Z"
+            },
+            "datePublic": "2026-11-12T04:34:34.000Z",
+            "title": "Miniflux before 2.3.5 Insufficient Session Expiration After Password Change",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficient Session Expiration",
+                            "cweId": "CWE-613",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "miniflux",
+                    "product": "miniflux",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.3.5"
+                        }
+                    ],
+                    "packageURL": "pkg:golang/miniflux.app/v2"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.3.5"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.2,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-ch38-3q93-fwg8)"
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/commit/229035a4df6e60107d1117eb50696b23e08cb4b8",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/pull/4594",
+                    "tags": [
+                        "issue-tracking",
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/releases/tag/v2.3.5",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "miniflux v2.3.5 Release Notes"
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/blob/v2.3.4/internal/storage/user.go#L174-L190",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Miniflux before 2.3.5 Insufficient Session Expiration After Password Change",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/miniflux-before-2.3.5-insufficient-session-expiration-after-password-change"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Frédéric Guillot",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128331.json b/data/2026/128xxx/CVE-2026-128331.json
new file mode 100644
index 0000000000..9973cba3a1
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128331.json
@@ -0,0 +1,177 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128331",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:36.753Z",
+        "datePublished": "2026-11-13T09:33:42.840Z",
+        "dateUpdated": "2026-11-13T09:33:42.840Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:42.840Z"
+            },
+            "datePublic": "2026-11-12T04:34:34.000Z",
+            "title": "Miniflux before 2.3.5 Password Change Without Current Password via Settings Form",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Unverified Password Change",
+                            "cweId": "CWE-620",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "miniflux",
+                    "product": "miniflux",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "2.3.5"
+                        }
+                    ],
+                    "packageURL": "pkg:golang/miniflux.app/v2"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:*:*:*",
+                                    "versionEndExcluding": "2.3.5"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-ch38-3q93-fwg8)"
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/commit/f654f7c7675e5c4cbd6ef5bb5858aa8d9bdf2af1",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/pull/4596",
+                    "tags": [
+                        "issue-tracking",
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/releases/tag/v2.3.5",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "miniflux v2.3.5 Release Notes"
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/settings_update.go#L19-L98",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/form/settings.go#L126-L128",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Miniflux before 2.3.5 Password Change Without Current Password via Settings Form",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/miniflux-before-2.3.5-password-change-without-current-password-via-settings-form"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Sandipkumar sah",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Frédéric Guillot",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128332.json b/data/2026/128xxx/CVE-2026-128332.json
new file mode 100644
index 0000000000..3340fb3d02
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128332.json
@@ -0,0 +1,146 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128332",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:37.116Z",
+        "datePublished": "2026-11-13T09:33:42.195Z",
+        "dateUpdated": "2026-11-13T09:33:42.195Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:42.195Z"
+            },
+            "datePublic": "2026-11-09T17:50:28.000Z",
+            "title": "listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Restriction of Excessive Authentication Attempts",
+                            "cweId": "CWE-307",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "knadh",
+                    "product": "listmonk",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "6.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "7.0.0-beta.2"
+                        }
+                    ],
+                    "packageURL": "pkg:golang/github.com/knadh/listmonk"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/knadh/listmonk/commit/3f62a55c13dbc679b29238e890e4b90d6d4996d8",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "listmonk v7.0.0-beta.2 Release Notes"
+                },
+                {
+                    "url": "https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/internal/tmptokens/tmptokens.go#L13-L88",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/cmd/auth.go#L514-L568",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/listmonk-6.0.0-before-7.0.0-beta.2-totp-brute-force-via-admin-login-twofa"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Komiljon Ayubov",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Kailash Nadh",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128333.json b/data/2026/128xxx/CVE-2026-128333.json
new file mode 100644
index 0000000000..7b099d246a
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128333.json
@@ -0,0 +1,140 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128333",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:37.467Z",
+        "datePublished": "2026-11-13T09:33:41.508Z",
+        "dateUpdated": "2026-11-13T09:33:41.508Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:41.508Z"
+            },
+            "datePublic": "2026-11-01T16:47:53.000Z",
+            "title": "listmonk 6.0.0 before 7.0.0-beta.2 2FA Bypass via Password Reset Flow",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Critical Step in Authentication",
+                            "cweId": "CWE-304",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "knadh",
+                    "product": "listmonk",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "6.0.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "7.0.0-beta.2"
+                        }
+                    ],
+                    "packageURL": "pkg:golang/github.com/knadh/listmonk"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.1,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/knadh/listmonk/commit/14b25edc31614a1d661e3af72b3d46b887931534",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "listmonk v7.0.0-beta.2 Release Notes"
+                },
+                {
+                    "url": "https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/cmd/auth.go#L712-L766",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: listmonk 6.0.0 before 7.0.0-beta.2 2FA Bypass via Password Reset Flow",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/listmonk-6.0.0-before-7.0.0-beta.2-2fa-bypass-via-password-reset-flow"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Komiljon Ayubov",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Kailash Nadh",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128334.json b/data/2026/128xxx/CVE-2026-128334.json
new file mode 100644
index 0000000000..e8184d31d3
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128334.json
@@ -0,0 +1,151 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128334",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:37.824Z",
+        "datePublished": "2026-11-13T09:33:40.800Z",
+        "dateUpdated": "2026-11-13T09:33:40.800Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:40.800Z"
+            },
+            "datePublic": "2026-11-01T16:09:38.000Z",
+            "title": "listmonk 6.2.0 before 7.0.0-beta.2 Missing Authentication via Azure Bounce Webhook",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Not Failing Securely ('Failing Open')",
+                            "cweId": "CWE-636",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "knadh",
+                    "product": "listmonk",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "6.2.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "7.0.0-beta.2"
+                        }
+                    ],
+                    "packageURL": "pkg:golang/github.com/knadh/listmonk"
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/knadh/listmonk/commit/0c155bd2663d9ec8053ac0d1ab63f021fbb5a0dc",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "listmonk v7.0.0-beta.2 Release Notes"
+                },
+                {
+                    "url": "https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/internal/bounce/webhooks/azure.go#L141-L149",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/biofool/listmonk/issues/5",
+                    "tags": [
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: listmonk 6.2.0 before 7.0.0-beta.2 Missing Authentication via Azure Bounce Webhook",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/listmonk-6.2.0-before-7.0.0-beta.2-missing-authentication-via-azure-bounce-webhook"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Komiljon Ayubov",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Kenneth Kron",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Kailash Nadh",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128335.json b/data/2026/128xxx/CVE-2026-128335.json
new file mode 100644
index 0000000000..a4271f1b68
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128335.json
@@ -0,0 +1,215 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128335",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:38.188Z",
+        "datePublished": "2026-11-13T09:33:39.011Z",
+        "dateUpdated": "2026-11-13T09:33:39.011Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:39.011Z"
+            },
+            "datePublic": "2026-11-11T07:19:47.000Z",
+            "title": "Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficient Session Expiration",
+                            "cweId": "CWE-613",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Contao",
+                    "product": "Contao",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "4.6.0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "5.3.54"
+                        },
+                        {
+                            "version": "5.4.0-RC1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "5.7.17"
+                        },
+                        {
+                            "version": "6.0.0-RC1",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThan": "6.0.6"
+                        }
+                    ],
+                    "packageURL": "pkg:composer/contao/core-bundle"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "4.6.0",
+                                    "versionEndExcluding": "5.3.54"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "5.4.0-rc1",
+                                    "versionEndExcluding": "5.7.17"
+                                },
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
+                                    "versionStartIncluding": "6.0.0-rc1",
+                                    "versionEndExcluding": "6.0.6"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.1,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 3.7,
+                        "baseSeverity": "LOW"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc",
+                    "tags": [
+                        "vendor-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-5mg3-mv6j-57wc)"
+                },
+                {
+                    "url": "https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1",
+                    "tags": [
+                        "patch"
+                    ]
+                },
+                {
+                    "url": "https://github.com/contao/contao/releases/tag/5.3.54",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Contao 5.3.54 Release Notes"
+                },
+                {
+                    "url": "https://github.com/contao/contao/releases/tag/5.7.17",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Contao 5.7.17 Release Notes"
+                },
+                {
+                    "url": "https://github.com/contao/contao/releases/tag/6.0.6",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Contao 6.0.6 Release Notes"
+                },
+                {
+                    "url": "https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/contao-before-5.3.54-5.7.17-and-6.0.6-session-invalidation-failure-on-2fa-change"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Farhan Khan",
+                    "type": "finder"
+                },
+                {
+                    "lang": "en",
+                    "value": "Martin Auswöger",
+                    "type": "remediation developer"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128336.json b/data/2026/128xxx/CVE-2026-128336.json
new file mode 100644
index 0000000000..d1fee7ab1e
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128336.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128336",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:38.540Z",
+        "datePublished": "2026-11-13T09:33:38.327Z",
+        "dateUpdated": "2026-11-13T09:33:38.327Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:38.327Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Prototype Pollution via __proto__ Defined Name",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
+                            "cweId": "CWE-1321",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 4.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pwgq-2cgg-6ph9",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-pwgq-2cgg-6ph9)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L50-L52",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Prototype Pollution via __proto__ Defined Name",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-proto-defined-name"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128337.json b/data/2026/128xxx/CVE-2026-128337.json
new file mode 100644
index 0000000000..b8753669b2
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128337.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128337",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:39.850Z",
+        "datePublished": "2026-11-13T09:33:37.679Z",
+        "dateUpdated": "2026-11-13T09:33:37.679Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:37.679Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Prototype Pollution via x14 Conditional Formatting Rule ID",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
+                            "cweId": "CWE-1321",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 7,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-86ch-m4gp-r5xf",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-86ch-m4gp-r5xf)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L34-L42",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L55-L74",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Prototype Pollution via x14 Conditional Formatting Rule ID",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-x14-conditional-formatting-rule-id"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128338.json b/data/2026/128xxx/CVE-2026-128338.json
new file mode 100644
index 0000000000..6eb4b9af5e
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128338.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128338",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:40.277Z",
+        "datePublished": "2026-11-13T09:33:37.051Z",
+        "dateUpdated": "2026-11-13T09:33:37.051Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:37.051Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Memory Exhaustion via Unbounded Worksheet Column Range",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-w57r-3mm6-w6g7",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-w57r-3mm6-w6g7)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/column.js#L307-L316",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/col-xform.js#L43-L47",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Memory Exhaustion via Unbounded Worksheet Column Range",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-unbounded-worksheet-column-range"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128339.json b/data/2026/128xxx/CVE-2026-128339.json
new file mode 100644
index 0000000000..1cc538a496
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128339.json
@@ -0,0 +1,171 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128339",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:40.642Z",
+        "datePublished": "2026-11-13T09:33:36.382Z",
+        "dateUpdated": "2026-11-13T09:33:36.382Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:36.382Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-wh3v-83h4-rwwq)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/issues/3107",
+                    "tags": [
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/pull/3114",
+                    "tags": [
+                        "issue-tracking",
+                        "patch"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128340.json b/data/2026/128xxx/CVE-2026-128340.json
new file mode 100644
index 0000000000..73bca87def
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128340.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128340",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:41.029Z",
+        "datePublished": "2026-11-13T09:33:35.713Z",
+        "dateUpdated": "2026-11-13T09:33:35.713Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:35.713Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load()."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qvh4-wwpm-ggc8)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L28-L37",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-defined-name-range"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128341.json b/data/2026/128xxx/CVE-2026-128341.json
new file mode 100644
index 0000000000..c5a0601f08
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128341.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128341",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:41.404Z",
+        "datePublished": "2026-11-13T09:33:35.085Z",
+        "dateUpdated": "2026-11-13T09:33:35.085Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:35.085Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f689-fh93-2pm2",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-f689-fh93-2pm2)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/data-validations-xform.js#L216-L227",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/issues/3093",
+                    "tags": [
+                        "issue-tracking"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-data-validation-sqref"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128342.json b/data/2026/128xxx/CVE-2026-128342.json
new file mode 100644
index 0000000000..a7677ed98f
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128342.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128342",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:41.765Z",
+        "datePublished": "2026-11-13T09:33:34.387Z",
+        "dateUpdated": "2026-11-13T09:33:34.387Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:34.387Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Denial of Service via Oversized Worksheet sheetId",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and writeBuffer for seconds."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Unchecked Input for Loop Condition",
+                            "cweId": "CWE-606",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9vv6-5g3h-prg5",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-9vv6-5g3h-prg5)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L200-L206",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L119-L125",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Denial of Service via Oversized Worksheet sheetId",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-worksheet-sheetid"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128343.json b/data/2026/128xxx/CVE-2026-128343.json
new file mode 100644
index 0000000000..7c1f56cfc3
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128343.json
@@ -0,0 +1,164 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128343",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:42.132Z",
+        "datePublished": "2026-11-13T09:33:33.699Z",
+        "dateUpdated": "2026-11-13T09:33:33.699Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:33.699Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Denial of Service via Oversized Row Number",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Unchecked Input for Loop Condition",
+                            "cweId": "CWE-606",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-3gm5-qxj8-89rr)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Denial of Service via Oversized Row Number",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128344.json b/data/2026/128xxx/CVE-2026-128344.json
new file mode 100644
index 0000000000..88f7dc4085
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128344.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128344",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:42.495Z",
+        "datePublished": "2026-11-13T09:33:33.044Z",
+        "dateUpdated": "2026-11-13T09:33:33.044Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:33.044Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Allocation of Resources Without Limits or Throttling",
+                            "cweId": "CWE-770",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-cqmf-h7c5-g7xx",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-cqmf-h7c5-g7xx)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/anchor.js#L40-L64",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L243-L261",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-image-anchor-column"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128345.json b/data/2026/128xxx/CVE-2026-128345.json
new file mode 100644
index 0000000000..0a48a7e18d
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128345.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128345",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:42.856Z",
+        "datePublished": "2026-11-13T09:33:32.358Z",
+        "dateUpdated": "2026-11-13T09:33:32.358Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:32.358Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 ReDoS via slideFormula Shared Formula Translation",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Inefficient Regular Expression Complexity",
+                            "cweId": "CWE-1333",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "LOW",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "LOW",
+                        "baseScore": 5.3,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pr65-54q8-vhqm",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-pr65-54q8-vhqm)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/shared-formula.js#L4-L12",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 ReDoS via slideFormula Shared Formula Translation",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-redos-via-slideformula-shared-formula-translation"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128346.json b/data/2026/128xxx/CVE-2026-128346.json
new file mode 100644
index 0000000000..9a5fb1712b
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128346.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128346",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:43.213Z",
+        "datePublished": "2026-11-13T09:33:31.709Z",
+        "dateUpdated": "2026-11-13T09:33:31.709Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:31.709Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Resource Exhaustion via Streaming WorkbookReader Temporary Files",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Incomplete Cleanup",
+                            "cweId": "CWE-459",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-mp7v-gxhv-42h2",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-mp7v-gxhv-42h2)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-reader.js#L111-L128",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-reader.js#L140-L149",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Resource Exhaustion via Streaming WorkbookReader Temporary Files",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-resource-exhaustion-via-streaming-workbookreader-temporary-files"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128347.json b/data/2026/128xxx/CVE-2026-128347.json
new file mode 100644
index 0000000000..b225fb4873
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128347.json
@@ -0,0 +1,158 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128347",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:43.575Z",
+        "datePublished": "2026-11-13T09:33:31.024Z",
+        "dateUpdated": "2026-11-13T09:33:31.024Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:31.024Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "External Control of File Name or Path",
+                            "cweId": "CWE-73",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-f9m8-8qmf-qq29)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128348.json b/data/2026/128xxx/CVE-2026-128348.json
new file mode 100644
index 0000000000..57418358de
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128348.json
@@ -0,0 +1,152 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-128348",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-11-13T01:20:43.948Z",
+        "datePublished": "2026-11-13T09:33:30.358Z",
+        "dateUpdated": "2026-11-13T09:33:30.358Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:33:30.358Z"
+            },
+            "datePublic": "2026-10-16T00:00:00.000Z",
+            "title": "ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Encoding or Escaping of Output",
+                            "cweId": "CWE-116",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "exceljs",
+                    "product": "exceljs",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "status": "affected",
+                            "versionType": "semver",
+                            "lessThanOrEqual": "4.4.0"
+                        }
+                    ],
+                    "packageURL": "pkg:npm/exceljs"
+                }
+            ],
+            "cpeApplicability": [
+                {
+                    "nodes": [
+                        {
+                            "operator": "OR",
+                            "negate": false,
+                            "cpeMatch": [
+                                {
+                                    "vulnerable": true,
+                                    "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
+                                    "versionEndIncluding": "4.4.0"
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "PASSIVE",
+                        "vulnConfidentialityImpact": "LOW",
+                        "vulnIntegrityImpact": "LOW",
+                        "vulnAvailabilityImpact": "NONE",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 2.3,
+                        "baseSeverity": "LOW"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "REQUIRED",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "LOW",
+                        "integrityImpact": "LOW",
+                        "availabilityImpact": "NONE",
+                        "baseScore": 4.2,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://github.com/exceljs/exceljs",
+                    "tags": [
+                        "product"
+                    ]
+                },
+                {
+                    "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "name": "GitHub Security Advisory (GHSA-qjfh-3mh9-356v)"
+                },
+                {
+                    "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104",
+                    "tags": [
+                        "technical-description"
+                    ]
+                },
+                {
+                    "name": "VulnCheck Advisory: ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Matéo Florian Callec",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/61xxx/CVE-2026-61417.json b/data/2026/61xxx/CVE-2026-61417.json
new file mode 100644
index 0000000000..183c89ebf2
--- /dev/null
+++ b/data/2026/61xxx/CVE-2026-61417.json
@@ -0,0 +1,109 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-61417",
+        "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+        "state": "PUBLISHED",
+        "assignerShortName": "dell",
+        "dateReserved": "2026-07-09T11:05:01.706Z",
+        "datePublished": "2026-11-13T09:25:30.595Z",
+        "dateUpdated": "2026-11-13T09:25:30.595Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+                "shortName": "dell",
+                "dateUpdated": "2026-11-13T09:25:30.595Z"
+            },
+            "datePublic": "2026-11-05T06:30:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-284",
+                            "description": "CWE-284: Improper Access Control",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Dell",
+                    "product": "SmartFabric OS10 Software",
+                    "versions": [
+                        {
+                            "status": "affected",
+                            "version": "0",
+                            "lessThan": "10.6.0.10",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."
+                        }
+                    ]
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities",
+                    "tags": [
+                        "vendor-advisory"
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseSeverity": "MEDIUM",
+                        "baseScore": 6.5,
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Dell would like to thank saltedfish for reporting this issue.",
+                    "type": "reporter"
+                }
+            ],
+            "source": {
+                "discovery": "UNKNOWN"
+            },
+            "x_generator": {
+                "engine": "Vulnogram 1.0.5"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/61xxx/CVE-2026-61418.json b/data/2026/61xxx/CVE-2026-61418.json
new file mode 100644
index 0000000000..400f3c03ba
--- /dev/null
+++ b/data/2026/61xxx/CVE-2026-61418.json
@@ -0,0 +1,109 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-61418",
+        "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+        "state": "PUBLISHED",
+        "assignerShortName": "dell",
+        "dateReserved": "2026-07-09T11:05:01.707Z",
+        "datePublished": "2026-11-13T09:29:52.220Z",
+        "dateUpdated": "2026-11-13T09:29:52.220Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+                "shortName": "dell",
+                "dateUpdated": "2026-11-13T09:29:52.220Z"
+            },
+            "datePublic": "2026-11-05T06:30:00.000Z",
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "cweId": "CWE-863",
+                            "description": "CWE-863: Incorrect Authorization",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Dell",
+                    "product": "SmartFabric OS10 Software",
+                    "versions": [
+                        {
+                            "status": "affected",
+                            "version": "0",
+                            "lessThan": "10.6.0.10",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.",
+                    "supportingMedia": [
+                        {
+                            "type": "text/html",
+                            "base64": false,
+                            "value": "Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution."
+                        }
+                    ]
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities",
+                    "tags": [
+                        "vendor-advisory"
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "scenarios": [
+                        {
+                            "lang": "en",
+                            "value": "GENERAL"
+                        }
+                    ],
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "LOW",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseSeverity": "HIGH",
+                        "baseScore": 7.5,
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Dell would like to thank Huynh Dinh Vu (WinD39) and Huynh Dinh Van for reporting this issue.",
+                    "type": "reporter"
+                }
+            ],
+            "source": {
+                "discovery": "UNKNOWN"
+            },
+            "x_generator": {
+                "engine": "Vulnogram 1.0.5"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75487.json b/data/2026/75xxx/CVE-2026-75487.json
new file mode 100644
index 0000000000..44690c8f83
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75487.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75487",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.282Z",
+        "datePublished": "2026-11-13T09:36:59.203Z",
+        "dateUpdated": "2026-11-13T09:36:59.203Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:59.203Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Command Injection via WireGuard private_key Export",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                            "cweId": "CWE-78",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via WireGuard private_key Export",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-wireguard-private-key-export"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75488.json b/data/2026/75xxx/CVE-2026-75488.json
new file mode 100644
index 0000000000..0d77b61280
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75488.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75488",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.282Z",
+        "datePublished": "2026-11-13T09:36:58.518Z",
+        "dateUpdated": "2026-11-13T09:36:58.518Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:58.518Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Stack Buffer Overflow via CWMP Basic Authorization Builder",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Stack-based Buffer Overflow",
+                            "cweId": "CWE-121",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Stack Buffer Overflow via CWMP Basic Authorization Builder",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-stack-buffer-overflow-via-cwmp-basic-authorization-builder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75489.json b/data/2026/75xxx/CVE-2026-75489.json
new file mode 100644
index 0000000000..4156becd66
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75489.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75489",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.283Z",
+        "datePublished": "2026-11-13T09:36:57.850Z",
+        "dateUpdated": "2026-11-13T09:36:57.850Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:57.850Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Insufficient Verification of Data Authenticity",
+                            "cweId": "CWE-345",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "ADJACENT",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 6.1,
+                        "baseSeverity": "MEDIUM"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
+                        "attackVector": "ADJACENT_NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-smt-message-forgery-via-probe-request-vendor-ie"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75490.json b/data/2026/75xxx/CVE-2026-75490.json
new file mode 100644
index 0000000000..db781f5bbb
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75490.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75490",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.283Z",
+        "datePublished": "2026-11-13T09:36:57.148Z",
+        "dateUpdated": "2026-11-13T09:36:57.148Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:57.148Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Missing Authentication for Critical Function",
+                            "cweId": "CWE-306",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "ADJACENT",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 7.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "ADJACENT_NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-unauthenticated-rce-via-mdns-automesh-broker-adoption"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75491.json b/data/2026/75xxx/CVE-2026-75491.json
new file mode 100644
index 0000000000..b1cf84a551
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75491.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75491",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.283Z",
+        "datePublished": "2026-11-13T09:36:56.502Z",
+        "dateUpdated": "2026-11-13T09:36:56.502Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:56.502Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Verification of Cryptographic Signature",
+                            "cweId": "CWE-347",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-mqtt-jwt-authentication-bypass-via-alg-none-tokens"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75492.json b/data/2026/75xxx/CVE-2026-75492.json
new file mode 100644
index 0000000000..9a33be9cd5
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75492.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75492",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.283Z",
+        "datePublished": "2026-11-13T09:36:55.820Z",
+        "dateUpdated": "2026-11-13T09:36:55.820Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:55.820Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Stack Buffer Overflow via stun_client UDP Parser",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stun_client for denial of service."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Stack-based Buffer Overflow",
+                            "cweId": "CWE-121",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.7,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.5,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Stack Buffer Overflow via stun_client UDP Parser",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-stack-buffer-overflow-via-stun-client-udp-parser"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75493.json b/data/2026/75xxx/CVE-2026-75493.json
new file mode 100644
index 0000000000..b0ec8939ac
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75493.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75493",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.283Z",
+        "datePublished": "2026-11-13T09:36:55.144Z",
+        "dateUpdated": "2026-11-13T09:36:55.144Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:55.144Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Stack-based Buffer Overflow",
+                            "cweId": "CWE-121",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "NONE",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.2,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "NONE",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 5.9,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-stack-buffer-overflow-via-obuspa-keypassphrase-getter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75494.json b/data/2026/75xxx/CVE-2026-75494.json
new file mode 100644
index 0000000000..7c8b8d5283
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75494.json
@@ -0,0 +1,134 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75494",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.283Z",
+        "datePublished": "2026-11-13T09:36:54.477Z",
+        "dateUpdated": "2026-11-13T09:36:54.477Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:54.477Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')",
+                            "cweId": "CWE-88",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "NONE",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.3,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "NONE",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.4,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-curl-argument-injection-via-tr-069-upload"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Jincheng Wang (@winmt)",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75495.json b/data/2026/75xxx/CVE-2026-75495.json
new file mode 100644
index 0000000000..d2d95b5cd3
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75495.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75495",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T20:07:25.283Z",
+        "datePublished": "2026-11-13T09:36:53.808Z",
+        "dateUpdated": "2026-11-13T09:36:53.808Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:53.808Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                            "cweId": "CWE-78",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "attackRequirements": "PRESENT",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 9.2,
+                        "baseSeverity": "CRITICAL"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "HIGH",
+                        "privilegesRequired": "NONE",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 8.1,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-os-command-injection-via-tr-098-user-password-parameter"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75576.json b/data/2026/75xxx/CVE-2026-75576.json
new file mode 100644
index 0000000000..001b14b560
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75576.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75576",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T22:02:43.611Z",
+        "datePublished": "2026-11-13T09:36:53.086Z",
+        "dateUpdated": "2026-11-13T09:36:53.086Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:53.086Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Command Injection via VPN Configuration Upload Filename",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration file through the VPN client config page with a filename containing $() shell substitution, which is passed through Lua %q to /bin/sh -c."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                            "cweId": "CWE-78",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via VPN Configuration Upload Filename",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-configuration-upload-filename"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75577.json b/data/2026/75xxx/CVE-2026-75577.json
new file mode 100644
index 0000000000..41358385c9
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75577.json
@@ -0,0 +1,127 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75577",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T22:02:43.612Z",
+        "datePublished": "2026-11-13T09:36:52.428Z",
+        "dateUpdated": "2026-11-13T09:36:52.428Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:52.428Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                            "cweId": "CWE-78",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-export-conf-wireguard-private-key"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75578.json b/data/2026/75xxx/CVE-2026-75578.json
new file mode 100644
index 0000000000..c3bca055ad
--- /dev/null
+++ b/data/2026/75xxx/CVE-2026-75578.json
@@ -0,0 +1,134 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.2",
+    "cveMetadata": {
+        "cveId": "CVE-2026-75578",
+        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+        "state": "PUBLISHED",
+        "assignerShortName": "VulnCheck",
+        "dateReserved": "2026-08-17T22:02:43.612Z",
+        "datePublished": "2026-11-13T09:36:51.764Z",
+        "dateUpdated": "2026-11-13T09:36:51.764Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+                "shortName": "VulnCheck",
+                "dateUpdated": "2026-11-13T09:36:51.764Z"
+            },
+            "datePublic": "2026-11-12T00:00:00.000Z",
+            "title": "Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root."
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                            "cweId": "CWE-78",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+                    "product": "TR3000 1.0",
+                    "defaultStatus": "unaffected",
+                    "versions": [
+                        {
+                            "version": "0",
+                            "lessThan": "2.5.42",
+                            "status": "affected",
+                            "versionType": "semver"
+                        },
+                        {
+                            "version": "2.5.42",
+                            "status": "unaffected",
+                            "versionType": "semver"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "format": "CVSS",
+                    "cvssV4_0": {
+                        "version": "4.0",
+                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "attackRequirements": "NONE",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "vulnConfidentialityImpact": "HIGH",
+                        "vulnIntegrityImpact": "HIGH",
+                        "vulnAvailabilityImpact": "HIGH",
+                        "subConfidentialityImpact": "NONE",
+                        "subIntegrityImpact": "NONE",
+                        "subAvailabilityImpact": "NONE",
+                        "baseScore": 8.6,
+                        "baseSeverity": "HIGH"
+                    }
+                },
+                {
+                    "format": "CVSS",
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                        "attackVector": "NETWORK",
+                        "attackComplexity": "LOW",
+                        "privilegesRequired": "HIGH",
+                        "userInteraction": "NONE",
+                        "scope": "UNCHANGED",
+                        "confidentialityImpact": "HIGH",
+                        "integrityImpact": "HIGH",
+                        "availabilityImpact": "HIGH",
+                        "baseScore": 7.2,
+                        "baseSeverity": "HIGH"
+                    }
+                }
+            ],
+            "references": [
+                {
+                    "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+                    "tags": [
+                        "release-notes"
+                    ],
+                    "name": "Cudy TR3000 1.0 Download Center"
+                },
+                {
+                    "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+                    "tags": [
+                        "patch"
+                    ],
+                    "name": "Cudy TR3000 Firmware 2.5.42"
+                },
+                {
+                    "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload",
+                    "tags": [
+                        "third-party-advisory"
+                    ],
+                    "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-openvpn-client-configuration-upload"
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "value": "Jincheng Wang (@winmt)",
+                    "type": "finder"
+                }
+            ],
+            "x_generator": {
+                "engine": "vulncheck-endgame"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/data/2026/9xxx/CVE-2026-9271.json b/data/2026/9xxx/CVE-2026-9271.json
index 48505f4041..a788a81b24 100644
--- a/data/2026/9xxx/CVE-2026-9271.json
+++ b/data/2026/9xxx/CVE-2026-9271.json
@@ -8,16 +8,38 @@
         "assignerShortName": "WPScan",
         "dateReserved": "2026-05-22T10:27:21.437Z",
         "datePublished": "2026-06-12T06:00:02.052Z",
-        "dateUpdated": "2026-06-12T14:49:15.343Z"
+        "dateUpdated": "2026-11-13T09:15:31.473Z"
     },
     "containers": {
         "cna": {
             "providerMetadata": {
                 "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
                 "shortName": "WPScan",
-                "dateUpdated": "2026-06-12T06:00:02.052Z"
+                "dateUpdated": "2026-11-13T09:15:31.473Z"
             },
-            "title": "KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS",
+            "title": "KeepInMind - Dashboard Notes <= 0.8.5 - Contributor+ Stored XSS",
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The KeepInMind Dashboard Notes WordPress plugin through 0.8.5 does not properly sanitize note content submitted through its REST API, allowing users with a low-privileged role (such as Contributor, where an administrator has enabled it) to store CSS that redresses the administrator dashboard for credential phishing and denial of service; the fix released in 0.8.4.2 addressed only the editor interface and left the REST write path exploitable."
+                }
+            ],
+            "affected": [
+                {
+                    "vendor": "Unknown",
+                    "product": "KeepInMind Dashboard Notes",
+                    "collectionURL": "https://wordpress.org/plugins",
+                    "defaultStatus": "unknown",
+                    "versions": [
+                        {
+                            "status": "affected",
+                            "versionType": "semver",
+                            "version": "0",
+                            "lessThanOrEqual": "0.8.5"
+                        }
+                    ]
+                }
+            ],
             "problemTypes": [
                 {
                     "descriptions": [
@@ -29,27 +51,6 @@
                     ]
                 }
             ],
-            "affected": [
-                {
-                    "vendor": "Unknown",
-                    "product": "KeepInMind Dashboard Notes",
-                    "versions": [
-                        {
-                            "status": "affected",
-                            "versionType": "semver",
-                            "version": "0",
-                            "lessThan": "0.8.4.2"
-                        }
-                    ],
-                    "defaultStatus": "unaffected"
-                }
-            ],
-            "descriptions": [
-                {
-                    "lang": "en",
-                    "value": "Vulnerability Title"
-                }
-            ],
             "references": [
                 {
                     "url": "https://wpscan.com/vulnerability/b5d549b7-17c8-417d-a86a-a7ae356a6eab/",
@@ -60,6 +61,16 @@
                     ]
                 }
             ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
+                        "baseScore": 6.8,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
             "credits": [
                 {
                     "lang": "en",
diff --git a/data/delta.json b/data/delta.json
index ba3209f9ff..1cc6da647e 100644
--- a/data/delta.json
+++ b/data/delta.json
@@ -1,56 +1,20 @@
 {
-  "fetchTime": "2026-11-13T09:13:39.579Z",
-  "numberOfChanges": 8,
+  "fetchTime": "2026-11-13T10:15:18.996Z",
+  "numberOfChanges": 2,
   "new": [
     {
-      "cveId": "CVE-2026-116420",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116420",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116420.json",
-      "dateUpdated": "2026-11-13T09:08:33.704Z"
-    },
-    {
-      "cveId": "CVE-2026-116425",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116425",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116425.json",
-      "dateUpdated": "2026-11-13T09:12:08.116Z"
-    },
-    {
-      "cveId": "CVE-2026-116430",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116430",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116430.json",
-      "dateUpdated": "2026-11-13T09:02:22.496Z"
-    },
-    {
-      "cveId": "CVE-2026-116431",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116431",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116431.json",
-      "dateUpdated": "2026-11-13T09:05:36.362Z"
-    },
-    {
-      "cveId": "CVE-2026-128824",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128824",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128824.json",
-      "dateUpdated": "2026-11-13T09:00:23.537Z"
+      "cveId": "CVE-2026-112182",
+      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112182",
+      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112182.json",
+      "dateUpdated": "2026-11-13T10:11:27.327Z"
     }
   ],
   "updated": [
     {
-      "cveId": "CVE-2026-110697",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110697",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110697.json",
-      "dateUpdated": "2026-11-13T09:13:00.690Z"
-    },
-    {
-      "cveId": "CVE-2026-112204",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112204",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112204.json",
-      "dateUpdated": "2026-11-13T09:02:44.683Z"
-    },
-    {
-      "cveId": "CVE-2026-112205",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112205",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112205.json",
-      "dateUpdated": "2026-11-13T09:03:13.688Z"
+      "cveId": "CVE-2026-112181",
+      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112181",
+      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112181.json",
+      "dateUpdated": "2026-11-13T10:13:21.512Z"
     }
   ],
   "error": []
diff --git a/data/deltaLog.json b/data/deltaLog.json
index 7f4185e25c..6c2570744e 100644
--- a/data/deltaLog.json
+++ b/data/deltaLog.json
@@ -1,4 +1,2092 @@
 [
+  {
+    "fetchTime": "2026-11-13T10:15:18.996Z",
+    "numberOfChanges": 2,
+    "new": [
+      {
+        "cveId": "CVE-2026-112182",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112182",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112182.json",
+        "dateUpdated": "2026-11-13T10:11:27.327Z"
+      }
+    ],
+    "updated": [
+      {
+        "cveId": "CVE-2026-112181",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112181",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112181.json",
+        "dateUpdated": "2026-11-13T10:13:21.512Z"
+      }
+    ],
+    "error": []
+  },
+  {
+    "fetchTime": "2026-11-13T10:05:15.271Z",
+    "numberOfChanges": 1,
+    "new": [],
+    "updated": [
+      {
+        "cveId": "CVE-2026-106172",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106172",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106172.json",
+        "dateUpdated": "2026-11-13T10:04:26.266Z"
+      }
+    ],
+    "error": []
+  },
+  {
+    "fetchTime": "2026-11-13T09:57:39.172Z",
+    "numberOfChanges": 1,
+    "new": [
+      {
+        "cveId": "CVE-2026-112181",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-112181",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112181.json",
+        "dateUpdated": "2026-11-13T09:54:21.059Z"
+      }
+    ],
+    "updated": [],
+    "error": []
+  },
+  {
+    "fetchTime": "2026-11-13T09:46:09.305Z",
+    "numberOfChanges": 1,
+    "new": [],
+    "updated": [
+      {
+        "cveId": "CVE-2026-126396",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126396",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126396.json",
+        "dateUpdated": "2026-11-13T09:46:05.921Z"
+      }
+    ],
+    "error": []
+  },
+  {
+    "fetchTime": "2026-11-13T09:40:11.970Z",
+    "numberOfChanges": 237,
+    "new": [
+      {
+        "cveId": "CVE-2023-54423",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2023-54423",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/54xxx/CVE-2023-54423.json",
+        "dateUpdated": "2026-11-13T09:37:04.518Z"
+      },
+      {
+        "cveId": "CVE-2024-58404",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-58404",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/58xxx/CVE-2024-58404.json",
+        "dateUpdated": "2026-11-13T09:37:03.888Z"
+      },
+      {
+        "cveId": "CVE-2024-58405",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-58405",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/58xxx/CVE-2024-58405.json",
+        "dateUpdated": "2026-11-13T09:37:03.249Z"
+      },
+      {
+        "cveId": "CVE-2025-71459",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-71459",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71459.json",
+        "dateUpdated": "2026-11-13T09:37:02.598Z"
+      },
+      {
+        "cveId": "CVE-2025-71460",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-71460",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71460.json",
+        "dateUpdated": "2026-11-13T09:37:01.929Z"
+      },
+      {
+        "cveId": "CVE-2025-71461",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-71461",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71461.json",
+        "dateUpdated": "2026-11-13T09:37:01.263Z"
+      },
+      {
+        "cveId": "CVE-2025-71462",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-71462",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71462.json",
+        "dateUpdated": "2026-11-13T09:37:00.586Z"
+      },
+      {
+        "cveId": "CVE-2025-71463",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-71463",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71463.json",
+        "dateUpdated": "2026-11-13T09:36:59.897Z"
+      },
+      {
+        "cveId": "CVE-2026-103645",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103645",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103645.json",
+        "dateUpdated": "2026-11-13T09:36:23.530Z"
+      },
+      {
+        "cveId": "CVE-2026-115871",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115871",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115871.json",
+        "dateUpdated": "2026-11-13T09:35:10.951Z"
+      },
+      {
+        "cveId": "CVE-2026-116509",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116509",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116509.json",
+        "dateUpdated": "2026-11-13T09:35:15.539Z"
+      },
+      {
+        "cveId": "CVE-2026-116614",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116614",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116614.json",
+        "dateUpdated": "2026-11-13T09:35:13.682Z"
+      },
+      {
+        "cveId": "CVE-2026-116615",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116615",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116615.json",
+        "dateUpdated": "2026-11-13T09:35:12.566Z"
+      },
+      {
+        "cveId": "CVE-2026-118191",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118191",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118191.json",
+        "dateUpdated": "2026-11-13T09:35:15.166Z"
+      },
+      {
+        "cveId": "CVE-2026-118587",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-118587",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118587.json",
+        "dateUpdated": "2026-11-13T09:35:18.085Z"
+      },
+      {
+        "cveId": "CVE-2026-119077",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119077",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119077.json",
+        "dateUpdated": "2026-11-13T09:35:17.360Z"
+      },
+      {
+        "cveId": "CVE-2026-120547",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120547",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120547.json",
+        "dateUpdated": "2026-11-13T09:35:11.842Z"
+      },
+      {
+        "cveId": "CVE-2026-120573",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120573",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120573.json",
+        "dateUpdated": "2026-11-13T09:35:15.899Z"
+      },
+      {
+        "cveId": "CVE-2026-120658",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120658",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120658.json",
+        "dateUpdated": "2026-11-13T09:35:14.804Z"
+      },
+      {
+        "cveId": "CVE-2026-120688",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120688",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120688.json",
+        "dateUpdated": "2026-11-13T09:35:12.209Z"
+      },
+      {
+        "cveId": "CVE-2026-121518",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121518",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121518.json",
+        "dateUpdated": "2026-11-13T09:35:16.266Z"
+      },
+      {
+        "cveId": "CVE-2026-122063",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122063",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122063.json",
+        "dateUpdated": "2026-11-13T09:35:12.949Z"
+      },
+      {
+        "cveId": "CVE-2026-122227",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122227",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122227.json",
+        "dateUpdated": "2026-11-13T09:35:16.630Z"
+      },
+      {
+        "cveId": "CVE-2026-123769",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123769",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123769.json",
+        "dateUpdated": "2026-11-13T09:35:11.454Z"
+      },
+      {
+        "cveId": "CVE-2026-124218",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124218",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124218.json",
+        "dateUpdated": "2026-11-13T09:35:16.995Z"
+      },
+      {
+        "cveId": "CVE-2026-125055",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125055",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125055.json",
+        "dateUpdated": "2026-11-13T09:35:13.330Z"
+      },
+      {
+        "cveId": "CVE-2026-125409",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125409",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125409.json",
+        "dateUpdated": "2026-11-13T09:35:14.057Z"
+      },
+      {
+        "cveId": "CVE-2026-125948",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125948",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125948.json",
+        "dateUpdated": "2026-11-13T09:35:14.454Z"
+      },
+      {
+        "cveId": "CVE-2026-126029",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126029",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126029.json",
+        "dateUpdated": "2026-11-13T09:35:17.735Z"
+      },
+      {
+        "cveId": "CVE-2026-126264",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126264",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126264.json",
+        "dateUpdated": "2026-11-13T09:36:51.089Z"
+      },
+      {
+        "cveId": "CVE-2026-126265",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126265",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126265.json",
+        "dateUpdated": "2026-11-13T09:36:50.432Z"
+      },
+      {
+        "cveId": "CVE-2026-126266",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126266",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126266.json",
+        "dateUpdated": "2026-11-13T09:36:49.770Z"
+      },
+      {
+        "cveId": "CVE-2026-126267",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126267",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126267.json",
+        "dateUpdated": "2026-11-13T09:36:49.116Z"
+      },
+      {
+        "cveId": "CVE-2026-126268",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126268",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126268.json",
+        "dateUpdated": "2026-11-13T09:36:48.470Z"
+      },
+      {
+        "cveId": "CVE-2026-126269",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126269",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126269.json",
+        "dateUpdated": "2026-11-13T09:36:47.840Z"
+      },
+      {
+        "cveId": "CVE-2026-126270",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126270",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126270.json",
+        "dateUpdated": "2026-11-13T09:36:47.205Z"
+      },
+      {
+        "cveId": "CVE-2026-126271",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126271",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126271.json",
+        "dateUpdated": "2026-11-13T09:36:46.548Z"
+      },
+      {
+        "cveId": "CVE-2026-126272",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126272",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126272.json",
+        "dateUpdated": "2026-11-13T09:36:45.727Z"
+      },
+      {
+        "cveId": "CVE-2026-126273",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126273",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126273.json",
+        "dateUpdated": "2026-11-13T09:36:45.077Z"
+      },
+      {
+        "cveId": "CVE-2026-126274",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126274",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126274.json",
+        "dateUpdated": "2026-11-13T09:36:44.396Z"
+      },
+      {
+        "cveId": "CVE-2026-126275",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126275",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126275.json",
+        "dateUpdated": "2026-11-13T09:36:43.720Z"
+      },
+      {
+        "cveId": "CVE-2026-126276",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126276",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126276.json",
+        "dateUpdated": "2026-11-13T09:36:43.031Z"
+      },
+      {
+        "cveId": "CVE-2026-126277",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126277",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126277.json",
+        "dateUpdated": "2026-11-13T09:36:42.352Z"
+      },
+      {
+        "cveId": "CVE-2026-126278",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126278",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126278.json",
+        "dateUpdated": "2026-11-13T09:36:41.678Z"
+      },
+      {
+        "cveId": "CVE-2026-126279",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126279",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126279.json",
+        "dateUpdated": "2026-11-13T09:36:40.988Z"
+      },
+      {
+        "cveId": "CVE-2026-126280",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126280",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126280.json",
+        "dateUpdated": "2026-11-13T09:36:39.321Z"
+      },
+      {
+        "cveId": "CVE-2026-126281",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126281",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126281.json",
+        "dateUpdated": "2026-11-13T09:36:38.488Z"
+      },
+      {
+        "cveId": "CVE-2026-126282",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126282",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126282.json",
+        "dateUpdated": "2026-11-13T09:36:37.841Z"
+      },
+      {
+        "cveId": "CVE-2026-126283",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126283",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126283.json",
+        "dateUpdated": "2026-11-13T09:36:37.190Z"
+      },
+      {
+        "cveId": "CVE-2026-126284",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126284",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126284.json",
+        "dateUpdated": "2026-11-13T09:36:36.525Z"
+      },
+      {
+        "cveId": "CVE-2026-126285",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126285",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126285.json",
+        "dateUpdated": "2026-11-13T09:36:35.854Z"
+      },
+      {
+        "cveId": "CVE-2026-126286",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126286",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126286.json",
+        "dateUpdated": "2026-11-13T09:36:35.200Z"
+      },
+      {
+        "cveId": "CVE-2026-126287",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126287",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126287.json",
+        "dateUpdated": "2026-11-13T09:36:34.544Z"
+      },
+      {
+        "cveId": "CVE-2026-126288",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126288",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126288.json",
+        "dateUpdated": "2026-11-13T09:36:33.855Z"
+      },
+      {
+        "cveId": "CVE-2026-126289",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126289",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126289.json",
+        "dateUpdated": "2026-11-13T09:36:33.112Z"
+      },
+      {
+        "cveId": "CVE-2026-126290",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126290",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126290.json",
+        "dateUpdated": "2026-11-13T09:36:32.519Z"
+      },
+      {
+        "cveId": "CVE-2026-126291",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126291",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126291.json",
+        "dateUpdated": "2026-11-13T09:36:31.871Z"
+      },
+      {
+        "cveId": "CVE-2026-126292",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126292",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126292.json",
+        "dateUpdated": "2026-11-13T09:36:31.185Z"
+      },
+      {
+        "cveId": "CVE-2026-126293",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126293",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126293.json",
+        "dateUpdated": "2026-11-13T09:36:30.505Z"
+      },
+      {
+        "cveId": "CVE-2026-126294",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126294",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126294.json",
+        "dateUpdated": "2026-11-13T09:36:29.863Z"
+      },
+      {
+        "cveId": "CVE-2026-126295",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126295",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126295.json",
+        "dateUpdated": "2026-11-13T09:36:29.196Z"
+      },
+      {
+        "cveId": "CVE-2026-126296",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126296",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126296.json",
+        "dateUpdated": "2026-11-13T09:36:28.517Z"
+      },
+      {
+        "cveId": "CVE-2026-126297",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126297",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126297.json",
+        "dateUpdated": "2026-11-13T09:36:27.884Z"
+      },
+      {
+        "cveId": "CVE-2026-126298",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126298",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126298.json",
+        "dateUpdated": "2026-11-13T09:36:27.213Z"
+      },
+      {
+        "cveId": "CVE-2026-126299",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126299",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126299.json",
+        "dateUpdated": "2026-11-13T09:36:26.544Z"
+      },
+      {
+        "cveId": "CVE-2026-126300",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126300",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126300.json",
+        "dateUpdated": "2026-11-13T09:36:25.918Z"
+      },
+      {
+        "cveId": "CVE-2026-126301",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126301",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126301.json",
+        "dateUpdated": "2026-11-13T09:36:25.223Z"
+      },
+      {
+        "cveId": "CVE-2026-126302",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126302",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126302.json",
+        "dateUpdated": "2026-11-13T09:36:24.559Z"
+      },
+      {
+        "cveId": "CVE-2026-126303",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126303",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126303.json",
+        "dateUpdated": "2026-11-13T09:36:23.874Z"
+      },
+      {
+        "cveId": "CVE-2026-126304",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126304",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126304.json",
+        "dateUpdated": "2026-11-13T09:36:23.105Z"
+      },
+      {
+        "cveId": "CVE-2026-126305",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126305",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126305.json",
+        "dateUpdated": "2026-11-13T09:36:22.424Z"
+      },
+      {
+        "cveId": "CVE-2026-126306",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126306",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126306.json",
+        "dateUpdated": "2026-11-13T09:36:21.753Z"
+      },
+      {
+        "cveId": "CVE-2026-126307",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126307",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126307.json",
+        "dateUpdated": "2026-11-13T09:36:21.073Z"
+      },
+      {
+        "cveId": "CVE-2026-126308",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126308",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126308.json",
+        "dateUpdated": "2026-11-13T09:36:20.400Z"
+      },
+      {
+        "cveId": "CVE-2026-126309",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126309",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126309.json",
+        "dateUpdated": "2026-11-13T09:36:19.659Z"
+      },
+      {
+        "cveId": "CVE-2026-126310",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126310",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126310.json",
+        "dateUpdated": "2026-11-13T09:36:18.944Z"
+      },
+      {
+        "cveId": "CVE-2026-126311",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126311",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126311.json",
+        "dateUpdated": "2026-11-13T09:36:18.274Z"
+      },
+      {
+        "cveId": "CVE-2026-126312",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126312",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126312.json",
+        "dateUpdated": "2026-11-13T09:36:17.584Z"
+      },
+      {
+        "cveId": "CVE-2026-126313",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126313",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126313.json",
+        "dateUpdated": "2026-11-13T09:36:16.853Z"
+      },
+      {
+        "cveId": "CVE-2026-126314",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126314",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126314.json",
+        "dateUpdated": "2026-11-13T09:36:16.153Z"
+      },
+      {
+        "cveId": "CVE-2026-126315",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126315",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126315.json",
+        "dateUpdated": "2026-11-13T09:36:15.474Z"
+      },
+      {
+        "cveId": "CVE-2026-126316",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126316",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126316.json",
+        "dateUpdated": "2026-11-13T09:36:14.731Z"
+      },
+      {
+        "cveId": "CVE-2026-126317",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126317",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126317.json",
+        "dateUpdated": "2026-11-13T09:36:14.050Z"
+      },
+      {
+        "cveId": "CVE-2026-126318",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126318",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126318.json",
+        "dateUpdated": "2026-11-13T09:36:13.376Z"
+      },
+      {
+        "cveId": "CVE-2026-126319",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126319",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126319.json",
+        "dateUpdated": "2026-11-13T09:36:12.691Z"
+      },
+      {
+        "cveId": "CVE-2026-126320",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126320",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126320.json",
+        "dateUpdated": "2026-11-13T09:36:12.031Z"
+      },
+      {
+        "cveId": "CVE-2026-126321",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126321",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126321.json",
+        "dateUpdated": "2026-11-13T09:36:11.349Z"
+      },
+      {
+        "cveId": "CVE-2026-126322",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126322",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126322.json",
+        "dateUpdated": "2026-11-13T09:36:10.583Z"
+      },
+      {
+        "cveId": "CVE-2026-126323",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126323",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126323.json",
+        "dateUpdated": "2026-11-13T09:36:09.910Z"
+      },
+      {
+        "cveId": "CVE-2026-126369",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126369",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126369.json",
+        "dateUpdated": "2026-11-13T09:36:09.242Z"
+      },
+      {
+        "cveId": "CVE-2026-126370",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126370",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126370.json",
+        "dateUpdated": "2026-11-13T09:36:08.557Z"
+      },
+      {
+        "cveId": "CVE-2026-126371",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126371",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126371.json",
+        "dateUpdated": "2026-11-13T09:36:07.876Z"
+      },
+      {
+        "cveId": "CVE-2026-126372",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126372",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126372.json",
+        "dateUpdated": "2026-11-13T09:36:07.223Z"
+      },
+      {
+        "cveId": "CVE-2026-126373",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126373",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126373.json",
+        "dateUpdated": "2026-11-13T09:36:06.554Z"
+      },
+      {
+        "cveId": "CVE-2026-126374",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126374",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126374.json",
+        "dateUpdated": "2026-11-13T09:36:05.890Z"
+      },
+      {
+        "cveId": "CVE-2026-126375",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126375",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126375.json",
+        "dateUpdated": "2026-11-13T09:36:05.220Z"
+      },
+      {
+        "cveId": "CVE-2026-126376",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126376",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126376.json",
+        "dateUpdated": "2026-11-13T09:36:04.558Z"
+      },
+      {
+        "cveId": "CVE-2026-126377",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126377",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126377.json",
+        "dateUpdated": "2026-11-13T09:36:03.862Z"
+      },
+      {
+        "cveId": "CVE-2026-126378",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126378",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126378.json",
+        "dateUpdated": "2026-11-13T09:36:03.184Z"
+      },
+      {
+        "cveId": "CVE-2026-126379",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126379",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126379.json",
+        "dateUpdated": "2026-11-13T09:36:02.526Z"
+      },
+      {
+        "cveId": "CVE-2026-126380",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126380",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126380.json",
+        "dateUpdated": "2026-11-13T09:36:01.857Z"
+      },
+      {
+        "cveId": "CVE-2026-126381",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126381",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126381.json",
+        "dateUpdated": "2026-11-13T09:36:01.182Z"
+      },
+      {
+        "cveId": "CVE-2026-126382",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126382",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126382.json",
+        "dateUpdated": "2026-11-13T09:36:00.507Z"
+      },
+      {
+        "cveId": "CVE-2026-126383",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126383",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126383.json",
+        "dateUpdated": "2026-11-13T09:35:59.797Z"
+      },
+      {
+        "cveId": "CVE-2026-126384",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126384",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126384.json",
+        "dateUpdated": "2026-11-13T09:35:59.112Z"
+      },
+      {
+        "cveId": "CVE-2026-126385",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126385",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126385.json",
+        "dateUpdated": "2026-11-13T09:35:58.422Z"
+      },
+      {
+        "cveId": "CVE-2026-126386",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126386",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126386.json",
+        "dateUpdated": "2026-11-13T09:35:57.737Z"
+      },
+      {
+        "cveId": "CVE-2026-126387",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126387",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126387.json",
+        "dateUpdated": "2026-11-13T09:35:57.075Z"
+      },
+      {
+        "cveId": "CVE-2026-126388",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126388",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126388.json",
+        "dateUpdated": "2026-11-13T09:35:56.306Z"
+      },
+      {
+        "cveId": "CVE-2026-126389",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126389",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126389.json",
+        "dateUpdated": "2026-11-13T09:35:55.673Z"
+      },
+      {
+        "cveId": "CVE-2026-126390",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126390",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126390.json",
+        "dateUpdated": "2026-11-13T09:35:55.075Z"
+      },
+      {
+        "cveId": "CVE-2026-126391",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126391",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126391.json",
+        "dateUpdated": "2026-11-13T09:35:54.388Z"
+      },
+      {
+        "cveId": "CVE-2026-126392",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126392",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126392.json",
+        "dateUpdated": "2026-11-13T09:35:53.670Z"
+      },
+      {
+        "cveId": "CVE-2026-126393",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126393",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126393.json",
+        "dateUpdated": "2026-11-13T09:35:52.971Z"
+      },
+      {
+        "cveId": "CVE-2026-126394",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126394",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126394.json",
+        "dateUpdated": "2026-11-13T09:35:52.305Z"
+      },
+      {
+        "cveId": "CVE-2026-126395",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126395",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126395.json",
+        "dateUpdated": "2026-11-13T09:35:51.636Z"
+      },
+      {
+        "cveId": "CVE-2026-126396",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126396",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126396.json",
+        "dateUpdated": "2026-11-13T09:35:50.950Z"
+      },
+      {
+        "cveId": "CVE-2026-126397",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126397",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126397.json",
+        "dateUpdated": "2026-11-13T09:35:50.274Z"
+      },
+      {
+        "cveId": "CVE-2026-126398",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126398",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126398.json",
+        "dateUpdated": "2026-11-13T09:35:49.601Z"
+      },
+      {
+        "cveId": "CVE-2026-126399",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126399",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126399.json",
+        "dateUpdated": "2026-11-13T09:35:48.994Z"
+      },
+      {
+        "cveId": "CVE-2026-126400",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126400",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126400.json",
+        "dateUpdated": "2026-11-13T09:35:48.368Z"
+      },
+      {
+        "cveId": "CVE-2026-126401",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126401",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126401.json",
+        "dateUpdated": "2026-11-13T09:35:47.679Z"
+      },
+      {
+        "cveId": "CVE-2026-126402",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126402",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126402.json",
+        "dateUpdated": "2026-11-13T09:35:47.001Z"
+      },
+      {
+        "cveId": "CVE-2026-126403",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126403",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126403.json",
+        "dateUpdated": "2026-11-13T09:35:46.335Z"
+      },
+      {
+        "cveId": "CVE-2026-126404",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126404",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126404.json",
+        "dateUpdated": "2026-11-13T09:35:45.631Z"
+      },
+      {
+        "cveId": "CVE-2026-126405",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126405",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126405.json",
+        "dateUpdated": "2026-11-13T09:35:44.966Z"
+      },
+      {
+        "cveId": "CVE-2026-126406",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126406",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126406.json",
+        "dateUpdated": "2026-11-13T09:35:44.314Z"
+      },
+      {
+        "cveId": "CVE-2026-126407",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126407",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126407.json",
+        "dateUpdated": "2026-11-13T09:35:43.638Z"
+      },
+      {
+        "cveId": "CVE-2026-126408",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126408",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126408.json",
+        "dateUpdated": "2026-11-13T09:35:42.943Z"
+      },
+      {
+        "cveId": "CVE-2026-126409",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126409",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126409.json",
+        "dateUpdated": "2026-11-13T09:35:42.234Z"
+      },
+      {
+        "cveId": "CVE-2026-126410",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126410",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126410.json",
+        "dateUpdated": "2026-11-13T09:35:41.472Z"
+      },
+      {
+        "cveId": "CVE-2026-126411",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126411",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126411.json",
+        "dateUpdated": "2026-11-13T09:35:40.765Z"
+      },
+      {
+        "cveId": "CVE-2026-126412",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126412",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126412.json",
+        "dateUpdated": "2026-11-13T09:35:39.219Z"
+      },
+      {
+        "cveId": "CVE-2026-126413",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126413",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126413.json",
+        "dateUpdated": "2026-11-13T09:35:38.506Z"
+      },
+      {
+        "cveId": "CVE-2026-126414",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126414",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126414.json",
+        "dateUpdated": "2026-11-13T09:35:37.838Z"
+      },
+      {
+        "cveId": "CVE-2026-126415",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126415",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126415.json",
+        "dateUpdated": "2026-11-13T09:35:37.169Z"
+      },
+      {
+        "cveId": "CVE-2026-126416",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126416",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126416.json",
+        "dateUpdated": "2026-11-13T09:35:36.479Z"
+      },
+      {
+        "cveId": "CVE-2026-126417",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126417",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126417.json",
+        "dateUpdated": "2026-11-13T09:35:35.804Z"
+      },
+      {
+        "cveId": "CVE-2026-126418",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126418",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126418.json",
+        "dateUpdated": "2026-11-13T09:35:35.126Z"
+      },
+      {
+        "cveId": "CVE-2026-126419",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126419",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126419.json",
+        "dateUpdated": "2026-11-13T09:35:34.434Z"
+      },
+      {
+        "cveId": "CVE-2026-126420",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126420",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126420.json",
+        "dateUpdated": "2026-11-13T09:35:33.766Z"
+      },
+      {
+        "cveId": "CVE-2026-126421",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126421",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126421.json",
+        "dateUpdated": "2026-11-13T09:35:33.115Z"
+      },
+      {
+        "cveId": "CVE-2026-126422",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126422",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126422.json",
+        "dateUpdated": "2026-11-13T09:35:32.468Z"
+      },
+      {
+        "cveId": "CVE-2026-126423",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126423",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126423.json",
+        "dateUpdated": "2026-11-13T09:35:31.761Z"
+      },
+      {
+        "cveId": "CVE-2026-126424",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126424",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126424.json",
+        "dateUpdated": "2026-11-13T09:35:31.004Z"
+      },
+      {
+        "cveId": "CVE-2026-126425",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126425",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126425.json",
+        "dateUpdated": "2026-11-13T09:35:30.379Z"
+      },
+      {
+        "cveId": "CVE-2026-126426",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126426",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126426.json",
+        "dateUpdated": "2026-11-13T09:35:29.713Z"
+      },
+      {
+        "cveId": "CVE-2026-126427",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126427",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126427.json",
+        "dateUpdated": "2026-11-13T09:35:29.043Z"
+      },
+      {
+        "cveId": "CVE-2026-126428",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126428",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126428.json",
+        "dateUpdated": "2026-11-13T09:35:28.362Z"
+      },
+      {
+        "cveId": "CVE-2026-126429",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126429",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126429.json",
+        "dateUpdated": "2026-11-13T09:35:27.683Z"
+      },
+      {
+        "cveId": "CVE-2026-126430",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126430",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126430.json",
+        "dateUpdated": "2026-11-13T09:35:27.006Z"
+      },
+      {
+        "cveId": "CVE-2026-126431",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126431",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126431.json",
+        "dateUpdated": "2026-11-13T09:35:26.326Z"
+      },
+      {
+        "cveId": "CVE-2026-126432",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126432",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126432.json",
+        "dateUpdated": "2026-11-13T09:35:25.637Z"
+      },
+      {
+        "cveId": "CVE-2026-126433",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126433",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126433.json",
+        "dateUpdated": "2026-11-13T09:35:24.960Z"
+      },
+      {
+        "cveId": "CVE-2026-126434",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126434",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126434.json",
+        "dateUpdated": "2026-11-13T09:35:24.280Z"
+      },
+      {
+        "cveId": "CVE-2026-126435",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126435",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126435.json",
+        "dateUpdated": "2026-11-13T09:35:23.578Z"
+      },
+      {
+        "cveId": "CVE-2026-126436",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126436",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126436.json",
+        "dateUpdated": "2026-11-13T09:35:22.891Z"
+      },
+      {
+        "cveId": "CVE-2026-126437",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126437",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126437.json",
+        "dateUpdated": "2026-11-13T09:35:22.181Z"
+      },
+      {
+        "cveId": "CVE-2026-126438",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126438",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126438.json",
+        "dateUpdated": "2026-11-13T09:35:21.519Z"
+      },
+      {
+        "cveId": "CVE-2026-126439",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126439",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126439.json",
+        "dateUpdated": "2026-11-13T09:35:20.845Z"
+      },
+      {
+        "cveId": "CVE-2026-126440",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126440",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126440.json",
+        "dateUpdated": "2026-11-13T09:35:20.175Z"
+      },
+      {
+        "cveId": "CVE-2026-126441",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126441",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126441.json",
+        "dateUpdated": "2026-11-13T09:35:19.496Z"
+      },
+      {
+        "cveId": "CVE-2026-126442",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126442",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126442.json",
+        "dateUpdated": "2026-11-13T09:35:18.835Z"
+      },
+      {
+        "cveId": "CVE-2026-126443",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126443",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126443.json",
+        "dateUpdated": "2026-11-13T09:35:18.169Z"
+      },
+      {
+        "cveId": "CVE-2026-126444",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126444",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126444.json",
+        "dateUpdated": "2026-11-13T09:35:17.502Z"
+      },
+      {
+        "cveId": "CVE-2026-126445",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126445",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126445.json",
+        "dateUpdated": "2026-11-13T09:35:16.819Z"
+      },
+      {
+        "cveId": "CVE-2026-126446",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126446",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126446.json",
+        "dateUpdated": "2026-11-13T09:35:16.171Z"
+      },
+      {
+        "cveId": "CVE-2026-126447",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126447",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126447.json",
+        "dateUpdated": "2026-11-13T09:35:15.502Z"
+      },
+      {
+        "cveId": "CVE-2026-126448",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126448",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126448.json",
+        "dateUpdated": "2026-11-13T09:35:14.807Z"
+      },
+      {
+        "cveId": "CVE-2026-126449",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126449",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126449.json",
+        "dateUpdated": "2026-11-13T09:35:14.110Z"
+      },
+      {
+        "cveId": "CVE-2026-126450",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126450",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126450.json",
+        "dateUpdated": "2026-11-13T09:35:13.396Z"
+      },
+      {
+        "cveId": "CVE-2026-126451",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126451",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126451.json",
+        "dateUpdated": "2026-11-13T09:35:12.702Z"
+      },
+      {
+        "cveId": "CVE-2026-126452",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126452",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126452.json",
+        "dateUpdated": "2026-11-13T09:35:12.032Z"
+      },
+      {
+        "cveId": "CVE-2026-126453",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126453",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126453.json",
+        "dateUpdated": "2026-11-13T09:35:11.338Z"
+      },
+      {
+        "cveId": "CVE-2026-126454",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126454",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126454.json",
+        "dateUpdated": "2026-11-13T09:35:10.666Z"
+      },
+      {
+        "cveId": "CVE-2026-126455",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126455",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126455.json",
+        "dateUpdated": "2026-11-13T09:35:09.982Z"
+      },
+      {
+        "cveId": "CVE-2026-126456",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126456",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126456.json",
+        "dateUpdated": "2026-11-13T09:35:09.311Z"
+      },
+      {
+        "cveId": "CVE-2026-126457",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126457",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126457.json",
+        "dateUpdated": "2026-11-13T09:35:08.617Z"
+      },
+      {
+        "cveId": "CVE-2026-126458",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126458",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126458.json",
+        "dateUpdated": "2026-11-13T09:35:07.943Z"
+      },
+      {
+        "cveId": "CVE-2026-126460",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126460",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126460.json",
+        "dateUpdated": "2026-11-13T09:35:07.214Z"
+      },
+      {
+        "cveId": "CVE-2026-126461",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126461",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126461.json",
+        "dateUpdated": "2026-11-13T09:35:06.538Z"
+      },
+      {
+        "cveId": "CVE-2026-126462",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126462",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126462.json",
+        "dateUpdated": "2026-11-13T09:35:05.862Z"
+      },
+      {
+        "cveId": "CVE-2026-126463",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126463",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126463.json",
+        "dateUpdated": "2026-11-13T09:35:05.238Z"
+      },
+      {
+        "cveId": "CVE-2026-126464",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126464",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126464.json",
+        "dateUpdated": "2026-11-13T09:35:04.627Z"
+      },
+      {
+        "cveId": "CVE-2026-126465",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126465",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126465.json",
+        "dateUpdated": "2026-11-13T09:35:03.882Z"
+      },
+      {
+        "cveId": "CVE-2026-126466",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126466",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126466.json",
+        "dateUpdated": "2026-11-13T09:35:03.207Z"
+      },
+      {
+        "cveId": "CVE-2026-126467",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126467",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126467.json",
+        "dateUpdated": "2026-11-13T09:35:02.519Z"
+      },
+      {
+        "cveId": "CVE-2026-126468",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126468",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126468.json",
+        "dateUpdated": "2026-11-13T09:35:01.841Z"
+      },
+      {
+        "cveId": "CVE-2026-126469",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126469",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126469.json",
+        "dateUpdated": "2026-11-13T09:35:01.156Z"
+      },
+      {
+        "cveId": "CVE-2026-126470",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126470",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126470.json",
+        "dateUpdated": "2026-11-13T09:35:00.497Z"
+      },
+      {
+        "cveId": "CVE-2026-126471",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126471",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126471.json",
+        "dateUpdated": "2026-11-13T09:34:59.825Z"
+      },
+      {
+        "cveId": "CVE-2026-126472",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126472",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126472.json",
+        "dateUpdated": "2026-11-13T09:34:59.148Z"
+      },
+      {
+        "cveId": "CVE-2026-126473",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126473",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126473.json",
+        "dateUpdated": "2026-11-13T09:34:58.505Z"
+      },
+      {
+        "cveId": "CVE-2026-126474",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126474",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126474.json",
+        "dateUpdated": "2026-11-13T09:34:57.820Z"
+      },
+      {
+        "cveId": "CVE-2026-126475",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126475",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126475.json",
+        "dateUpdated": "2026-11-13T09:34:57.138Z"
+      },
+      {
+        "cveId": "CVE-2026-126476",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126476",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126476.json",
+        "dateUpdated": "2026-11-13T09:34:56.473Z"
+      },
+      {
+        "cveId": "CVE-2026-126477",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126477",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126477.json",
+        "dateUpdated": "2026-11-13T09:34:55.801Z"
+      },
+      {
+        "cveId": "CVE-2026-126478",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126478",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126478.json",
+        "dateUpdated": "2026-11-13T09:34:55.106Z"
+      },
+      {
+        "cveId": "CVE-2026-126479",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126479",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126479.json",
+        "dateUpdated": "2026-11-13T09:34:54.427Z"
+      },
+      {
+        "cveId": "CVE-2026-126480",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126480",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126480.json",
+        "dateUpdated": "2026-11-13T09:34:53.694Z"
+      },
+      {
+        "cveId": "CVE-2026-126481",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126481",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126481.json",
+        "dateUpdated": "2026-11-13T09:34:52.945Z"
+      },
+      {
+        "cveId": "CVE-2026-126482",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126482",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126482.json",
+        "dateUpdated": "2026-11-13T09:34:52.242Z"
+      },
+      {
+        "cveId": "CVE-2026-126483",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126483",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126483.json",
+        "dateUpdated": "2026-11-13T09:34:51.565Z"
+      },
+      {
+        "cveId": "CVE-2026-126484",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126484",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126484.json",
+        "dateUpdated": "2026-11-13T09:34:50.915Z"
+      },
+      {
+        "cveId": "CVE-2026-126485",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126485",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126485.json",
+        "dateUpdated": "2026-11-13T09:34:50.219Z"
+      },
+      {
+        "cveId": "CVE-2026-126486",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126486",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126486.json",
+        "dateUpdated": "2026-11-13T09:34:49.523Z"
+      },
+      {
+        "cveId": "CVE-2026-126487",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126487",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126487.json",
+        "dateUpdated": "2026-11-13T09:34:48.664Z"
+      },
+      {
+        "cveId": "CVE-2026-126488",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126488",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126488.json",
+        "dateUpdated": "2026-11-13T09:34:47.993Z"
+      },
+      {
+        "cveId": "CVE-2026-126489",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126489",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126489.json",
+        "dateUpdated": "2026-11-13T09:34:47.310Z"
+      },
+      {
+        "cveId": "CVE-2026-126490",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126490",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126490.json",
+        "dateUpdated": "2026-11-13T09:34:45.798Z"
+      },
+      {
+        "cveId": "CVE-2026-126491",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126491",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126491.json",
+        "dateUpdated": "2026-11-13T09:34:45.073Z"
+      },
+      {
+        "cveId": "CVE-2026-126492",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126492",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126492.json",
+        "dateUpdated": "2026-11-13T09:34:43.205Z"
+      },
+      {
+        "cveId": "CVE-2026-126493",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126493",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126493.json",
+        "dateUpdated": "2026-11-13T09:34:42.519Z"
+      },
+      {
+        "cveId": "CVE-2026-126494",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126494",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126494.json",
+        "dateUpdated": "2026-11-13T09:34:41.832Z"
+      },
+      {
+        "cveId": "CVE-2026-126936",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126936",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126936.json",
+        "dateUpdated": "2026-11-13T09:34:41.165Z"
+      },
+      {
+        "cveId": "CVE-2026-126937",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126937",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126937.json",
+        "dateUpdated": "2026-11-13T09:34:40.499Z"
+      },
+      {
+        "cveId": "CVE-2026-126938",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126938",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126938.json",
+        "dateUpdated": "2026-11-13T09:34:39.833Z"
+      },
+      {
+        "cveId": "CVE-2026-126939",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126939",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126939.json",
+        "dateUpdated": "2026-11-13T09:34:39.144Z"
+      },
+      {
+        "cveId": "CVE-2026-126940",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126940",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126940.json",
+        "dateUpdated": "2026-11-13T09:34:38.463Z"
+      },
+      {
+        "cveId": "CVE-2026-126941",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126941",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126941.json",
+        "dateUpdated": "2026-11-13T09:34:37.786Z"
+      },
+      {
+        "cveId": "CVE-2026-126942",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126942",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126942.json",
+        "dateUpdated": "2026-11-13T09:34:37.092Z"
+      },
+      {
+        "cveId": "CVE-2026-126943",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126943",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126943.json",
+        "dateUpdated": "2026-11-13T09:34:36.421Z"
+      },
+      {
+        "cveId": "CVE-2026-126944",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126944",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126944.json",
+        "dateUpdated": "2026-11-13T09:34:35.737Z"
+      },
+      {
+        "cveId": "CVE-2026-126945",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126945",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126945.json",
+        "dateUpdated": "2026-11-13T09:34:35.069Z"
+      },
+      {
+        "cveId": "CVE-2026-126946",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126946",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126946.json",
+        "dateUpdated": "2026-11-13T09:34:34.387Z"
+      },
+      {
+        "cveId": "CVE-2026-75487",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75487",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75487.json",
+        "dateUpdated": "2026-11-13T09:36:59.203Z"
+      },
+      {
+        "cveId": "CVE-2026-75488",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75488",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75488.json",
+        "dateUpdated": "2026-11-13T09:36:58.518Z"
+      },
+      {
+        "cveId": "CVE-2026-75489",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75489",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75489.json",
+        "dateUpdated": "2026-11-13T09:36:57.850Z"
+      },
+      {
+        "cveId": "CVE-2026-75490",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75490",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75490.json",
+        "dateUpdated": "2026-11-13T09:36:57.148Z"
+      },
+      {
+        "cveId": "CVE-2026-75491",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75491",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75491.json",
+        "dateUpdated": "2026-11-13T09:36:56.502Z"
+      },
+      {
+        "cveId": "CVE-2026-75492",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75492",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75492.json",
+        "dateUpdated": "2026-11-13T09:36:55.820Z"
+      },
+      {
+        "cveId": "CVE-2026-75493",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75493",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75493.json",
+        "dateUpdated": "2026-11-13T09:36:55.144Z"
+      },
+      {
+        "cveId": "CVE-2026-75494",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75494",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75494.json",
+        "dateUpdated": "2026-11-13T09:36:54.477Z"
+      },
+      {
+        "cveId": "CVE-2026-75495",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75495",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75495.json",
+        "dateUpdated": "2026-11-13T09:36:53.808Z"
+      },
+      {
+        "cveId": "CVE-2026-75576",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75576",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75576.json",
+        "dateUpdated": "2026-11-13T09:36:53.086Z"
+      },
+      {
+        "cveId": "CVE-2026-75577",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75577",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75577.json",
+        "dateUpdated": "2026-11-13T09:36:52.428Z"
+      },
+      {
+        "cveId": "CVE-2026-75578",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75578",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75578.json",
+        "dateUpdated": "2026-11-13T09:36:51.764Z"
+      }
+    ],
+    "updated": [],
+    "error": []
+  },
+  {
+    "fetchTime": "2026-11-13T09:34:34.689Z",
+    "numberOfChanges": 91,
+    "new": [
+      {
+        "cveId": "CVE-2026-126947",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126947",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126947.json",
+        "dateUpdated": "2026-11-13T09:34:33.705Z"
+      },
+      {
+        "cveId": "CVE-2026-126948",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126948",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126948.json",
+        "dateUpdated": "2026-11-13T09:34:33.024Z"
+      },
+      {
+        "cveId": "CVE-2026-126949",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126949",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126949.json",
+        "dateUpdated": "2026-11-13T09:34:32.349Z"
+      },
+      {
+        "cveId": "CVE-2026-126950",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126950",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126950.json",
+        "dateUpdated": "2026-11-13T09:34:31.656Z"
+      },
+      {
+        "cveId": "CVE-2026-126951",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126951",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126951.json",
+        "dateUpdated": "2026-11-13T09:34:30.968Z"
+      },
+      {
+        "cveId": "CVE-2026-126952",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126952",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126952.json",
+        "dateUpdated": "2026-11-13T09:34:30.285Z"
+      },
+      {
+        "cveId": "CVE-2026-126953",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126953",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126953.json",
+        "dateUpdated": "2026-11-13T09:34:29.604Z"
+      },
+      {
+        "cveId": "CVE-2026-126954",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126954",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126954.json",
+        "dateUpdated": "2026-11-13T09:34:28.893Z"
+      },
+      {
+        "cveId": "CVE-2026-126955",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126955",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126955.json",
+        "dateUpdated": "2026-11-13T09:34:28.194Z"
+      },
+      {
+        "cveId": "CVE-2026-127073",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127073",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127073.json",
+        "dateUpdated": "2026-11-13T09:34:27.520Z"
+      },
+      {
+        "cveId": "CVE-2026-127074",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127074",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127074.json",
+        "dateUpdated": "2026-11-13T09:34:26.848Z"
+      },
+      {
+        "cveId": "CVE-2026-127075",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127075",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127075.json",
+        "dateUpdated": "2026-11-13T09:34:26.178Z"
+      },
+      {
+        "cveId": "CVE-2026-127076",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127076",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127076.json",
+        "dateUpdated": "2026-11-13T09:34:25.444Z"
+      },
+      {
+        "cveId": "CVE-2026-127077",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127077",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127077.json",
+        "dateUpdated": "2026-11-13T09:34:24.783Z"
+      },
+      {
+        "cveId": "CVE-2026-127078",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127078",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127078.json",
+        "dateUpdated": "2026-11-13T09:34:22.785Z"
+      },
+      {
+        "cveId": "CVE-2026-127079",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127079",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127079.json",
+        "dateUpdated": "2026-11-13T09:34:22.100Z"
+      },
+      {
+        "cveId": "CVE-2026-127080",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127080",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127080.json",
+        "dateUpdated": "2026-11-13T09:34:21.479Z"
+      },
+      {
+        "cveId": "CVE-2026-127081",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127081",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127081.json",
+        "dateUpdated": "2026-11-13T09:34:20.852Z"
+      },
+      {
+        "cveId": "CVE-2026-127082",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127082",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127082.json",
+        "dateUpdated": "2026-11-13T09:34:20.176Z"
+      },
+      {
+        "cveId": "CVE-2026-127083",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127083",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127083.json",
+        "dateUpdated": "2026-11-13T09:34:19.470Z"
+      },
+      {
+        "cveId": "CVE-2026-127084",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127084",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127084.json",
+        "dateUpdated": "2026-11-13T09:34:18.830Z"
+      },
+      {
+        "cveId": "CVE-2026-127085",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127085",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127085.json",
+        "dateUpdated": "2026-11-13T09:34:18.133Z"
+      },
+      {
+        "cveId": "CVE-2026-127086",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127086",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127086.json",
+        "dateUpdated": "2026-11-13T09:34:17.416Z"
+      },
+      {
+        "cveId": "CVE-2026-127087",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127087",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127087.json",
+        "dateUpdated": "2026-11-13T09:34:16.780Z"
+      },
+      {
+        "cveId": "CVE-2026-127088",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127088",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127088.json",
+        "dateUpdated": "2026-11-13T09:34:16.098Z"
+      },
+      {
+        "cveId": "CVE-2026-127090",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127090",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127090.json",
+        "dateUpdated": "2026-11-13T09:34:15.399Z"
+      },
+      {
+        "cveId": "CVE-2026-127091",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127091",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127091.json",
+        "dateUpdated": "2026-11-13T09:34:14.761Z"
+      },
+      {
+        "cveId": "CVE-2026-127092",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127092",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127092.json",
+        "dateUpdated": "2026-11-13T09:34:14.088Z"
+      },
+      {
+        "cveId": "CVE-2026-127093",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127093",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127093.json",
+        "dateUpdated": "2026-11-13T09:34:13.400Z"
+      },
+      {
+        "cveId": "CVE-2026-127094",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127094",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127094.json",
+        "dateUpdated": "2026-11-13T09:34:12.707Z"
+      },
+      {
+        "cveId": "CVE-2026-128014",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128014",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128014.json",
+        "dateUpdated": "2026-11-13T09:34:12.011Z"
+      },
+      {
+        "cveId": "CVE-2026-128015",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128015",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128015.json",
+        "dateUpdated": "2026-11-13T09:34:11.325Z"
+      },
+      {
+        "cveId": "CVE-2026-128016",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128016",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128016.json",
+        "dateUpdated": "2026-11-13T09:34:10.667Z"
+      },
+      {
+        "cveId": "CVE-2026-128017",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128017",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128017.json",
+        "dateUpdated": "2026-11-13T09:34:09.979Z"
+      },
+      {
+        "cveId": "CVE-2026-128018",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128018",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128018.json",
+        "dateUpdated": "2026-11-13T09:34:09.269Z"
+      },
+      {
+        "cveId": "CVE-2026-128019",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128019",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128019.json",
+        "dateUpdated": "2026-11-13T09:34:08.571Z"
+      },
+      {
+        "cveId": "CVE-2026-128020",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128020",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128020.json",
+        "dateUpdated": "2026-11-13T09:34:07.894Z"
+      },
+      {
+        "cveId": "CVE-2026-128021",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128021",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128021.json",
+        "dateUpdated": "2026-11-13T09:34:07.192Z"
+      },
+      {
+        "cveId": "CVE-2026-128022",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128022",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128022.json",
+        "dateUpdated": "2026-11-13T09:34:06.526Z"
+      },
+      {
+        "cveId": "CVE-2026-128023",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128023",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128023.json",
+        "dateUpdated": "2026-11-13T09:34:05.836Z"
+      },
+      {
+        "cveId": "CVE-2026-128024",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128024",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128024.json",
+        "dateUpdated": "2026-11-13T09:34:05.162Z"
+      },
+      {
+        "cveId": "CVE-2026-128025",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128025",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128025.json",
+        "dateUpdated": "2026-11-13T09:34:04.485Z"
+      },
+      {
+        "cveId": "CVE-2026-128026",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128026",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128026.json",
+        "dateUpdated": "2026-11-13T09:34:03.804Z"
+      },
+      {
+        "cveId": "CVE-2026-128027",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128027",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128027.json",
+        "dateUpdated": "2026-11-13T09:34:03.119Z"
+      },
+      {
+        "cveId": "CVE-2026-128028",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128028",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128028.json",
+        "dateUpdated": "2026-11-13T09:34:02.436Z"
+      },
+      {
+        "cveId": "CVE-2026-128029",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128029",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128029.json",
+        "dateUpdated": "2026-11-13T09:34:01.768Z"
+      },
+      {
+        "cveId": "CVE-2026-128030",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128030",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128030.json",
+        "dateUpdated": "2026-11-13T09:34:01.082Z"
+      },
+      {
+        "cveId": "CVE-2026-128031",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128031",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128031.json",
+        "dateUpdated": "2026-11-13T09:34:00.400Z"
+      },
+      {
+        "cveId": "CVE-2026-128032",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128032",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128032.json",
+        "dateUpdated": "2026-11-13T09:33:59.721Z"
+      },
+      {
+        "cveId": "CVE-2026-128033",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128033",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128033.json",
+        "dateUpdated": "2026-11-13T09:33:59.025Z"
+      },
+      {
+        "cveId": "CVE-2026-128040",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128040",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128040.json",
+        "dateUpdated": "2026-11-13T09:33:58.324Z"
+      },
+      {
+        "cveId": "CVE-2026-128041",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128041",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128041.json",
+        "dateUpdated": "2026-11-13T09:33:57.636Z"
+      },
+      {
+        "cveId": "CVE-2026-128042",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128042",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128042.json",
+        "dateUpdated": "2026-11-13T09:33:56.952Z"
+      },
+      {
+        "cveId": "CVE-2026-128043",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128043",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128043.json",
+        "dateUpdated": "2026-11-13T09:33:56.263Z"
+      },
+      {
+        "cveId": "CVE-2026-128044",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128044",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128044.json",
+        "dateUpdated": "2026-11-13T09:33:55.592Z"
+      },
+      {
+        "cveId": "CVE-2026-128045",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128045",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128045.json",
+        "dateUpdated": "2026-11-13T09:33:54.917Z"
+      },
+      {
+        "cveId": "CVE-2026-128046",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128046",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128046.json",
+        "dateUpdated": "2026-11-13T09:33:54.254Z"
+      },
+      {
+        "cveId": "CVE-2026-128047",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128047",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128047.json",
+        "dateUpdated": "2026-11-13T09:33:53.555Z"
+      },
+      {
+        "cveId": "CVE-2026-128048",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128048",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128048.json",
+        "dateUpdated": "2026-11-13T09:33:52.864Z"
+      },
+      {
+        "cveId": "CVE-2026-128049",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128049",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128049.json",
+        "dateUpdated": "2026-11-13T09:33:52.073Z"
+      },
+      {
+        "cveId": "CVE-2026-128051",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128051",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128051.json",
+        "dateUpdated": "2026-11-13T09:33:51.362Z"
+      },
+      {
+        "cveId": "CVE-2026-128052",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128052",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128052.json",
+        "dateUpdated": "2026-11-13T09:33:50.608Z"
+      },
+      {
+        "cveId": "CVE-2026-128053",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128053",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128053.json",
+        "dateUpdated": "2026-11-13T09:33:49.875Z"
+      },
+      {
+        "cveId": "CVE-2026-128237",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128237",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128237.json",
+        "dateUpdated": "2026-11-13T09:33:49.101Z"
+      },
+      {
+        "cveId": "CVE-2026-128238",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128238",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128238.json",
+        "dateUpdated": "2026-11-13T09:33:48.401Z"
+      },
+      {
+        "cveId": "CVE-2026-128239",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128239",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128239.json",
+        "dateUpdated": "2026-11-13T09:33:47.579Z"
+      },
+      {
+        "cveId": "CVE-2026-128240",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128240",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128240.json",
+        "dateUpdated": "2026-11-13T09:33:46.903Z"
+      },
+      {
+        "cveId": "CVE-2026-128241",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128241",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128241.json",
+        "dateUpdated": "2026-11-13T09:33:46.216Z"
+      },
+      {
+        "cveId": "CVE-2026-128242",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128242",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128242.json",
+        "dateUpdated": "2026-11-13T09:33:45.553Z"
+      },
+      {
+        "cveId": "CVE-2026-128328",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128328",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128328.json",
+        "dateUpdated": "2026-11-13T09:33:44.878Z"
+      },
+      {
+        "cveId": "CVE-2026-128329",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128329",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128329.json",
+        "dateUpdated": "2026-11-13T09:33:44.203Z"
+      },
+      {
+        "cveId": "CVE-2026-128330",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128330",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128330.json",
+        "dateUpdated": "2026-11-13T09:33:43.522Z"
+      },
+      {
+        "cveId": "CVE-2026-128331",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128331",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128331.json",
+        "dateUpdated": "2026-11-13T09:33:42.840Z"
+      },
+      {
+        "cveId": "CVE-2026-128332",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128332",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128332.json",
+        "dateUpdated": "2026-11-13T09:33:42.195Z"
+      },
+      {
+        "cveId": "CVE-2026-128333",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128333",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128333.json",
+        "dateUpdated": "2026-11-13T09:33:41.508Z"
+      },
+      {
+        "cveId": "CVE-2026-128334",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128334",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128334.json",
+        "dateUpdated": "2026-11-13T09:33:40.800Z"
+      },
+      {
+        "cveId": "CVE-2026-128335",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128335",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128335.json",
+        "dateUpdated": "2026-11-13T09:33:39.011Z"
+      },
+      {
+        "cveId": "CVE-2026-128336",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128336",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128336.json",
+        "dateUpdated": "2026-11-13T09:33:38.327Z"
+      },
+      {
+        "cveId": "CVE-2026-128337",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128337",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128337.json",
+        "dateUpdated": "2026-11-13T09:33:37.679Z"
+      },
+      {
+        "cveId": "CVE-2026-128338",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128338",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128338.json",
+        "dateUpdated": "2026-11-13T09:33:37.051Z"
+      },
+      {
+        "cveId": "CVE-2026-128339",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128339",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128339.json",
+        "dateUpdated": "2026-11-13T09:33:36.382Z"
+      },
+      {
+        "cveId": "CVE-2026-128340",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128340",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128340.json",
+        "dateUpdated": "2026-11-13T09:33:35.713Z"
+      },
+      {
+        "cveId": "CVE-2026-128341",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128341",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128341.json",
+        "dateUpdated": "2026-11-13T09:33:35.085Z"
+      },
+      {
+        "cveId": "CVE-2026-128342",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128342",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128342.json",
+        "dateUpdated": "2026-11-13T09:33:34.387Z"
+      },
+      {
+        "cveId": "CVE-2026-128343",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128343",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128343.json",
+        "dateUpdated": "2026-11-13T09:33:33.699Z"
+      },
+      {
+        "cveId": "CVE-2026-128344",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128344",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128344.json",
+        "dateUpdated": "2026-11-13T09:33:33.044Z"
+      },
+      {
+        "cveId": "CVE-2026-128345",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128345",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128345.json",
+        "dateUpdated": "2026-11-13T09:33:32.358Z"
+      },
+      {
+        "cveId": "CVE-2026-128346",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128346",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128346.json",
+        "dateUpdated": "2026-11-13T09:33:31.709Z"
+      },
+      {
+        "cveId": "CVE-2026-128347",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128347",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128347.json",
+        "dateUpdated": "2026-11-13T09:33:31.024Z"
+      },
+      {
+        "cveId": "CVE-2026-128348",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-128348",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/128xxx/CVE-2026-128348.json",
+        "dateUpdated": "2026-11-13T09:33:30.358Z"
+      },
+      {
+        "cveId": "CVE-2026-61418",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-61418",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/61xxx/CVE-2026-61418.json",
+        "dateUpdated": "2026-11-13T09:29:52.220Z"
+      }
+    ],
+    "updated": [],
+    "error": []
+  },
+  {
+    "fetchTime": "2026-11-13T09:28:04.236Z",
+    "numberOfChanges": 1,
+    "new": [
+      {
+        "cveId": "CVE-2026-61417",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-61417",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/61xxx/CVE-2026-61417.json",
+        "dateUpdated": "2026-11-13T09:25:30.595Z"
+      }
+    ],
+    "updated": [],
+    "error": []
+  },
+  {
+    "fetchTime": "2026-11-13T09:21:36.437Z",
+    "numberOfChanges": 3,
+    "new": [
+      {
+        "cveId": "CVE-2026-116418",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116418",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116418.json",
+        "dateUpdated": "2026-11-13T09:20:16.351Z"
+      },
+      {
+        "cveId": "CVE-2026-116433",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116433",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116433.json",
+        "dateUpdated": "2026-11-13T09:16:36.792Z"
+      }
+    ],
+    "updated": [
+      {
+        "cveId": "CVE-2026-9271",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-9271",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9271.json",
+        "dateUpdated": "2026-11-13T09:15:31.473Z"
+      }
+    ],
+    "error": []
+  },
   {
     "fetchTime": "2026-11-13T09:13:39.579Z",
     "numberOfChanges": 8,
@@ -807021,571 +809109,5 @@
       }
     ],
     "error": []
-  },
-  {
-    "fetchTime": "2026-10-14T10:02:02.075Z",
-    "numberOfChanges": 9,
-    "new": [
-      {
-        "cveId": "CVE-2026-100231",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100231",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100231.json",
-        "dateUpdated": "2026-10-14T10:00:54.252Z"
-      },
-      {
-        "cveId": "CVE-2026-109969",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109969",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109969.json",
-        "dateUpdated": "2026-10-14T10:00:57.493Z"
-      },
-      {
-        "cveId": "CVE-2026-109970",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109970",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109970.json",
-        "dateUpdated": "2026-10-14T10:01:01.533Z"
-      },
-      {
-        "cveId": "CVE-2026-109971",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109971",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109971.json",
-        "dateUpdated": "2026-10-14T10:01:05.070Z"
-      },
-      {
-        "cveId": "CVE-2026-86476",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86476",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86476.json",
-        "dateUpdated": "2026-10-14T10:00:02.763Z"
-      },
-      {
-        "cveId": "CVE-2026-88829",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-88829",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88829.json",
-        "dateUpdated": "2026-10-14T10:00:42.946Z"
-      },
-      {
-        "cveId": "CVE-2026-90954",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90954",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90954.json",
-        "dateUpdated": "2026-10-14T10:00:08.215Z"
-      }
-    ],
-    "updated": [
-      {
-        "cveId": "CVE-2021-3999",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3999",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3999.json",
-        "dateUpdated": "2026-10-14T09:59:03.285Z"
-      },
-      {
-        "cveId": "CVE-2026-109832",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109832",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109832.json",
-        "dateUpdated": "2026-10-14T10:00:20.685Z"
-      }
-    ],
-    "error": []
-  },
-  {
-    "fetchTime": "2026-10-14T09:56:02.554Z",
-    "numberOfChanges": 16,
-    "new": [
-      {
-        "cveId": "CVE-2026-73794",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-73794",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73794.json",
-        "dateUpdated": "2026-10-14T09:53:55.966Z"
-      }
-    ],
-    "updated": [
-      {
-        "cveId": "CVE-2021-3326",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3326",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3326.json",
-        "dateUpdated": "2026-10-14T09:49:35.490Z"
-      },
-      {
-        "cveId": "CVE-2021-3426",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3426",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3426.json",
-        "dateUpdated": "2026-10-14T09:49:37.022Z"
-      },
-      {
-        "cveId": "CVE-2021-3516",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3516",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3516.json",
-        "dateUpdated": "2026-10-14T09:49:38.431Z"
-      },
-      {
-        "cveId": "CVE-2021-3517",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3517",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3517.json",
-        "dateUpdated": "2026-10-14T09:49:39.985Z"
-      },
-      {
-        "cveId": "CVE-2021-3518",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3518",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3518.json",
-        "dateUpdated": "2026-10-14T09:49:41.511Z"
-      },
-      {
-        "cveId": "CVE-2021-3520",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3520",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3520.json",
-        "dateUpdated": "2026-10-14T09:49:43.089Z"
-      },
-      {
-        "cveId": "CVE-2021-3537",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3537",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3537.json",
-        "dateUpdated": "2026-10-14T09:49:44.455Z"
-      },
-      {
-        "cveId": "CVE-2021-3541",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3541",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3541.json",
-        "dateUpdated": "2026-10-14T09:49:46.010Z"
-      },
-      {
-        "cveId": "CVE-2021-3580",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3580",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3580.json",
-        "dateUpdated": "2026-10-14T09:49:47.666Z"
-      },
-      {
-        "cveId": "CVE-2021-3733",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3733",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3733.json",
-        "dateUpdated": "2026-10-14T09:49:49.275Z"
-      },
-      {
-        "cveId": "CVE-2021-3737",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3737",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3737.json",
-        "dateUpdated": "2026-10-14T09:49:50.701Z"
-      },
-      {
-        "cveId": "CVE-2021-3759",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3759",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3759.json",
-        "dateUpdated": "2026-10-14T09:49:52.088Z"
-      },
-      {
-        "cveId": "CVE-2021-3826",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3826",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3826.json",
-        "dateUpdated": "2026-10-14T09:49:53.506Z"
-      },
-      {
-        "cveId": "CVE-2021-3997",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3997",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3997.json",
-        "dateUpdated": "2026-10-14T09:49:55.103Z"
-      },
-      {
-        "cveId": "CVE-2021-3998",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3998",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3998.json",
-        "dateUpdated": "2026-10-14T09:54:24.028Z"
-      }
-    ],
-    "error": []
-  },
-  {
-    "fetchTime": "2026-10-14T09:48:16.350Z",
-    "numberOfChanges": 21,
-    "new": [
-      {
-        "cveId": "CVE-2026-73793",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-73793",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73793.json",
-        "dateUpdated": "2026-10-14T09:38:03.947Z"
-      }
-    ],
-    "updated": [
-      {
-        "cveId": "CVE-2020-27618",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-27618",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/27xxx/CVE-2020-27618.json",
-        "dateUpdated": "2026-10-14T09:40:00.533Z"
-      },
-      {
-        "cveId": "CVE-2020-28196",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-28196",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/28xxx/CVE-2020-28196.json",
-        "dateUpdated": "2026-10-14T09:40:02.342Z"
-      },
-      {
-        "cveId": "CVE-2020-29361",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-29361",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/29xxx/CVE-2020-29361.json",
-        "dateUpdated": "2026-10-14T09:40:03.969Z"
-      },
-      {
-        "cveId": "CVE-2020-29362",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-29362",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/29xxx/CVE-2020-29362.json",
-        "dateUpdated": "2026-10-14T09:40:05.626Z"
-      },
-      {
-        "cveId": "CVE-2020-29363",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-29363",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/29xxx/CVE-2020-29363.json",
-        "dateUpdated": "2026-10-14T09:40:07.008Z"
-      },
-      {
-        "cveId": "CVE-2020-29562",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-29562",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/29xxx/CVE-2020-29562.json",
-        "dateUpdated": "2026-10-14T09:44:39.245Z"
-      },
-      {
-        "cveId": "CVE-2020-29573",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-29573",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/29xxx/CVE-2020-29573.json",
-        "dateUpdated": "2026-10-14T09:44:40.835Z"
-      },
-      {
-        "cveId": "CVE-2020-35525",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-35525",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35525.json",
-        "dateUpdated": "2026-10-14T09:44:44.196Z"
-      },
-      {
-        "cveId": "CVE-2020-35527",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-35527",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/35xxx/CVE-2020-35527.json",
-        "dateUpdated": "2026-10-14T09:44:45.701Z"
-      },
-      {
-        "cveId": "CVE-2020-36221",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36221",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36221.json",
-        "dateUpdated": "2026-10-14T09:44:47.237Z"
-      },
-      {
-        "cveId": "CVE-2020-36222",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36222",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36222.json",
-        "dateUpdated": "2026-10-14T09:44:48.652Z"
-      },
-      {
-        "cveId": "CVE-2020-36223",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36223",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36223.json",
-        "dateUpdated": "2026-10-14T09:44:50.223Z"
-      },
-      {
-        "cveId": "CVE-2020-36224",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36224",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36224.json",
-        "dateUpdated": "2026-10-14T09:44:51.787Z"
-      },
-      {
-        "cveId": "CVE-2020-36225",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36225",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36225.json",
-        "dateUpdated": "2026-10-14T09:44:55.147Z"
-      },
-      {
-        "cveId": "CVE-2020-36226",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36226",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36226.json",
-        "dateUpdated": "2026-10-14T09:44:56.508Z"
-      },
-      {
-        "cveId": "CVE-2020-36227",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36227",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36227.json",
-        "dateUpdated": "2026-10-14T09:44:58.084Z"
-      },
-      {
-        "cveId": "CVE-2020-36228",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36228",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36228.json",
-        "dateUpdated": "2026-10-14T09:44:59.633Z"
-      },
-      {
-        "cveId": "CVE-2020-36229",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36229",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36229.json",
-        "dateUpdated": "2026-10-14T09:45:01.213Z"
-      },
-      {
-        "cveId": "CVE-2020-36230",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-36230",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/36xxx/CVE-2020-36230.json",
-        "dateUpdated": "2026-10-14T09:45:02.657Z"
-      },
-      {
-        "cveId": "CVE-2021-3177",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-3177",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/3xxx/CVE-2021-3177.json",
-        "dateUpdated": "2026-10-14T09:45:04.275Z"
-      }
-    ],
-    "error": []
-  },
-  {
-    "fetchTime": "2026-10-14T09:37:11.959Z",
-    "numberOfChanges": 24,
-    "new": [],
-    "updated": [
-      {
-        "cveId": "CVE-2020-13871",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13871",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13871.json",
-        "dateUpdated": "2026-10-14T09:29:16.827Z"
-      },
-      {
-        "cveId": "CVE-2020-14145",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-14145",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14145.json",
-        "dateUpdated": "2026-10-14T09:29:18.190Z"
-      },
-      {
-        "cveId": "CVE-2020-14422",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-14422",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/14xxx/CVE-2020-14422.json",
-        "dateUpdated": "2026-10-14T09:29:19.735Z"
-      },
-      {
-        "cveId": "CVE-2020-15358",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-15358",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15358.json",
-        "dateUpdated": "2026-10-14T09:34:56.153Z"
-      },
-      {
-        "cveId": "CVE-2020-15523",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-15523",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15523.json",
-        "dateUpdated": "2026-10-14T09:34:57.771Z"
-      },
-      {
-        "cveId": "CVE-2020-15778",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-15778",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15778.json",
-        "dateUpdated": "2026-10-14T09:34:59.182Z"
-      },
-      {
-        "cveId": "CVE-2020-15801",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-15801",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/15xxx/CVE-2020-15801.json",
-        "dateUpdated": "2026-10-14T09:35:00.855Z"
-      },
-      {
-        "cveId": "CVE-2020-19185",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-19185",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/19xxx/CVE-2020-19185.json",
-        "dateUpdated": "2026-10-14T09:35:02.510Z"
-      },
-      {
-        "cveId": "CVE-2020-19186",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-19186",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/19xxx/CVE-2020-19186.json",
-        "dateUpdated": "2026-10-14T09:35:04.324Z"
-      },
-      {
-        "cveId": "CVE-2020-19187",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-19187",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/19xxx/CVE-2020-19187.json",
-        "dateUpdated": "2026-10-14T09:35:05.782Z"
-      },
-      {
-        "cveId": "CVE-2020-19188",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-19188",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/19xxx/CVE-2020-19188.json",
-        "dateUpdated": "2026-10-14T09:35:07.438Z"
-      },
-      {
-        "cveId": "CVE-2020-19189",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-19189",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/19xxx/CVE-2020-19189.json",
-        "dateUpdated": "2026-10-14T09:35:09.069Z"
-      },
-      {
-        "cveId": "CVE-2020-19190",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-19190",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/19xxx/CVE-2020-19190.json",
-        "dateUpdated": "2026-10-14T09:35:10.673Z"
-      },
-      {
-        "cveId": "CVE-2020-19909",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-19909",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/19xxx/CVE-2020-19909.json",
-        "dateUpdated": "2026-10-14T09:35:12.091Z"
-      },
-      {
-        "cveId": "CVE-2020-21047",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-21047",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/21xxx/CVE-2020-21047.json",
-        "dateUpdated": "2026-10-14T09:35:15.997Z"
-      },
-      {
-        "cveId": "CVE-2020-21913",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-21913",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/21xxx/CVE-2020-21913.json",
-        "dateUpdated": "2026-10-14T09:35:17.469Z"
-      },
-      {
-        "cveId": "CVE-2020-22218",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-22218",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/22xxx/CVE-2020-22218.json",
-        "dateUpdated": "2026-10-14T09:35:19.367Z"
-      },
-      {
-        "cveId": "CVE-2020-24659",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-24659",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/24xxx/CVE-2020-24659.json",
-        "dateUpdated": "2026-10-14T09:35:20.961Z"
-      },
-      {
-        "cveId": "CVE-2020-24977",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-24977",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/24xxx/CVE-2020-24977.json",
-        "dateUpdated": "2026-10-14T09:35:22.532Z"
-      },
-      {
-        "cveId": "CVE-2020-25692",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-25692",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/25xxx/CVE-2020-25692.json",
-        "dateUpdated": "2026-10-14T09:35:24.006Z"
-      },
-      {
-        "cveId": "CVE-2020-25709",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-25709",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/25xxx/CVE-2020-25709.json",
-        "dateUpdated": "2026-10-14T09:35:25.600Z"
-      },
-      {
-        "cveId": "CVE-2020-25710",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-25710",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/25xxx/CVE-2020-25710.json",
-        "dateUpdated": "2026-10-14T09:35:27.119Z"
-      },
-      {
-        "cveId": "CVE-2020-26116",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-26116",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/26xxx/CVE-2020-26116.json",
-        "dateUpdated": "2026-10-14T09:35:28.657Z"
-      },
-      {
-        "cveId": "CVE-2026-106172",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106172",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106172.json",
-        "dateUpdated": "2026-10-14T09:31:14.985Z"
-      }
-    ],
-    "error": []
-  },
-  {
-    "fetchTime": "2026-10-14T09:24:52.866Z",
-    "numberOfChanges": 17,
-    "new": [
-      {
-        "cveId": "CVE-2026-73791",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-73791",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73791.json",
-        "dateUpdated": "2026-10-14T09:06:31.616Z"
-      },
-      {
-        "cveId": "CVE-2026-73792",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-73792",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73792.json",
-        "dateUpdated": "2026-10-14T09:21:56.563Z"
-      }
-    ],
-    "updated": [
-      {
-        "cveId": "CVE-2020-11656",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-11656",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/11xxx/CVE-2020-11656.json",
-        "dateUpdated": "2026-10-14T09:06:49.203Z"
-      },
-      {
-        "cveId": "CVE-2020-12062",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-12062",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12062.json",
-        "dateUpdated": "2026-10-14T09:06:50.889Z"
-      },
-      {
-        "cveId": "CVE-2020-12243",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-12243",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12243.json",
-        "dateUpdated": "2026-10-14T09:06:54.182Z"
-      },
-      {
-        "cveId": "CVE-2020-12723",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-12723",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12723.json",
-        "dateUpdated": "2026-10-14T09:06:55.764Z"
-      },
-      {
-        "cveId": "CVE-2020-12762",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-12762",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/12xxx/CVE-2020-12762.json",
-        "dateUpdated": "2026-10-14T09:06:59.467Z"
-      },
-      {
-        "cveId": "CVE-2020-13434",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13434",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13434.json",
-        "dateUpdated": "2026-10-14T09:07:01.042Z"
-      },
-      {
-        "cveId": "CVE-2020-13435",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13435",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13435.json",
-        "dateUpdated": "2026-10-14T09:07:02.410Z"
-      },
-      {
-        "cveId": "CVE-2020-13529",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13529",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13529.json",
-        "dateUpdated": "2026-10-14T09:07:03.990Z"
-      },
-      {
-        "cveId": "CVE-2020-13630",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13630",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13630.json",
-        "dateUpdated": "2026-10-14T09:12:37.140Z"
-      },
-      {
-        "cveId": "CVE-2020-13631",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13631",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13631.json",
-        "dateUpdated": "2026-10-14T09:18:06.543Z"
-      },
-      {
-        "cveId": "CVE-2020-13632",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13632",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13632.json",
-        "dateUpdated": "2026-10-14T09:23:37.167Z"
-      },
-      {
-        "cveId": "CVE-2020-13776",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13776",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13776.json",
-        "dateUpdated": "2026-10-14T09:23:38.933Z"
-      },
-      {
-        "cveId": "CVE-2020-13777",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-13777",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/13xxx/CVE-2020-13777.json",
-        "dateUpdated": "2026-10-14T09:23:40.445Z"
-      },
-      {
-        "cveId": "CVE-2026-106931",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106931",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json",
-        "dateUpdated": "2026-10-14T09:09:32.417Z"
-      },
-      {
-        "cveId": "CVE-2026-43966",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-43966",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/43xxx/CVE-2026-43966.json",
-        "dateUpdated": "2026-10-14T09:22:13.888Z"
-      }
-    ],
-    "error": []
   }
 ]
\ No newline at end of file
diff --git a/state/sync.json b/state/sync.json
index 7b5008f8c9..afb2520a6f 100644
--- a/state/sync.json
+++ b/state/sync.json
@@ -1,7 +1,7 @@
 {
   "source": "https://github.com/CVEProject/cvelistV5.git",
-  "upstream_commit": "463a9f6b37ab4df4633a5d44d07561f143000550",
+  "upstream_commit": "bd9b14920365db9637c523d679b7082173dbcb7d",
   "since_year": 2017,
-  "records": 331877,
-  "synced_at_utc": "2026-11-13T09:25:29.122353+00:00"
+  "records": 332210,
+  "synced_at_utc": "2026-11-13T10:25:38.161225+00:00"
 }