VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-13T16:30:54Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-13 17:30:58 +01:00
1 parent ee401d30f9
commit 5de1f11943
226 files changed
+16063 -1910
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2024/58xxx/CVE-2024-58406.json
+151
View File
@@ -0,0 +1,151 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-58406",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T15:50:11.408Z",
"datePublished": "2026-11-13T15:57:13.779Z",
"dateUpdated": "2026-11-13T15:57:13.779Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T15:57:13.779Z"
},
"title": "Huatian OA8000 Path Traversal via ntkodownload.jsp",
"descriptions": [
{
"lang": "en",
"value": "Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20."
}
],
"tags": [
"x_known-exploited-vulnerability"
],
"datePublic": "2024-03-01T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "affected",
"vendor": "Dalian Huatian Software Co., Ltd.",
"product": "Huatian Dynamic OA8000",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"version": "3.1",
"baseSeverity": "HIGH",
"baseScore": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
}
],
"references": [
{
"url": "https://cn-sec.com/archives/2540697.html",
"name": "CN-SEC Write-up",
"tags": [
"technical-description",
"exploit"
]
},
{
"url": "https://www.oa8000.com/",
"name": "Product Page",
"tags": [
"product"
]
},
{
"url": "https://www.vulncheck.com/advisories/huatian-oa8000-path-traversal-via-ntkodownload-jsp",
"name": "VulnCheck Advisory: Huatian OA8000 Path Traversal via ntkodownload.jsp",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "The Shadowserver Foundation",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2025/71xxx/CVE-2025-71462.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:59:26.621Z",
"datePublished": "2026-11-13T09:37:00.586Z",
"dateUpdated": "2026-11-13T09:37:00.586Z"
"dateUpdated": "2026-11-13T15:52:48.602Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:30:54.975130Z",
"id": "CVE-2025-71462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:52:48.602Z"
}
}
]
}
}
data/2026/0xxx/CVE-2026-0193.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2025-10-23T08:45:46.329Z",
"datePublished": "2026-11-10T19:20:13.665Z",
"dateUpdated": "2026-11-10T19:20:13.665Z"
"dateUpdated": "2026-11-13T15:24:14.388Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-367",
"lang": "en",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 3.3,
"attackVector": "LOCAL",
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:24:10.890353Z",
"id": "CVE-2026-0193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:24:14.388Z"
}
}
]
}
}
data/2026/0xxx/CVE-2026-0195.json
+64 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2025-10-23T08:45:48.861Z",
"datePublished": "2026-11-10T19:20:14.622Z",
"dateUpdated": "2026-11-10T19:20:14.622Z"
"dateUpdated": "2026-11-13T15:25:02.114Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-125",
"lang": "en",
"description": "CWE-125 Out-of-bounds Read"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:24:53.173487Z",
"id": "CVE-2026-0195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:25:02.114Z"
}
}
]
}
}
data/2026/103xxx/CVE-2026-103769.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-01T10:49:33.286Z",
"datePublished": "2026-11-13T15:08:38.923Z",
"dateUpdated": "2026-11-13T15:08:38.923Z"
"dateUpdated": "2026-11-13T16:11:20.850Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:00:06.444437Z",
"id": "CVE-2026-103769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:11:20.850Z"
}
}
]
}
}
data/2026/103xxx/CVE-2026-103813.json
+284
View File
@@ -0,0 +1,284 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-103813",
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"state": "PUBLISHED",
"assignerShortName": "dell",
"dateReserved": "2026-10-01T11:04:15.920Z",
"datePublished": "2026-11-13T15:30:18.095Z",
"dateUpdated": "2026-11-13T15:30:18.095Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell",
"dateUpdated": "2026-11-13T15:30:18.095Z"
},
"datePublic": "2026-10-30T06:30:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Dell",
"product": "PowerStore 500T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 3200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200Q",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 7000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9000T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9200T",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 1500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 5500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Dell",
"product": "PowerStore 9500",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "5.1.0.0-2798105 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation to root on the appliance.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation to root on the appliance."
}
]
}
],
"references": [
{
"url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "CRITICAL",
"baseScore": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/105xxx/CVE-2026-105622.json
+130
View File
@@ -0,0 +1,130 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105622",
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"state": "PUBLISHED",
"assignerShortName": "Zenitel",
"dateReserved": "2026-10-05T16:30:58.403Z",
"datePublished": "2026-11-13T15:40:23.944Z",
"dateUpdated": "2026-11-13T15:40:23.944Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel",
"dateUpdated": "2026-11-13T15:40:23.944Z"
},
"title": "Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel",
"datePublic": "2026-11-13T15:40:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Zenitel",
"product": "Zenitel Connect",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.11.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0."
}
]
}
],
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.3,
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.11.0, which removes the WAMP-CRA authentication path",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<div><div><span>Upgrade to version 1.11.0, which removes the WAMP-CRA authentication path</span></div></div>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reported by ZeroSubnet",
"type": "reporter"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/105xxx/CVE-2026-105623.json
+130
View File
@@ -0,0 +1,130 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105623",
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"state": "PUBLISHED",
"assignerShortName": "Zenitel",
"dateReserved": "2026-10-05T16:31:04.052Z",
"datePublished": "2026-11-13T15:42:42.515Z",
"dateUpdated": "2026-11-13T15:42:42.515Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel",
"dateUpdated": "2026-11-13T15:42:42.515Z"
},
"title": "Zenitel Connect web interface serves production JavaScript source maps without authentication",
"datePublic": "2026-11-13T15:42:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-540",
"description": "CWE-540 Inclusion of Sensitive Information in Source Code",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Zenitel",
"product": "Zenitel Connect",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.11.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.</p>"
}
]
}
],
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.11.0",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Upgrade to version 1.11.0</p>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reported by ZeroSubnet",
"type": "reporter"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/105xxx/CVE-2026-105624.json
+130
View File
@@ -0,0 +1,130 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105624",
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"state": "PUBLISHED",
"assignerShortName": "Zenitel",
"dateReserved": "2026-10-05T16:31:06.093Z",
"datePublished": "2026-11-13T15:41:59.393Z",
"dateUpdated": "2026-11-13T15:41:59.393Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel",
"dateUpdated": "2026-11-13T15:41:59.393Z"
},
"title": "Zenitel Connect login allows account-lockout denial of service",
"datePublic": "2026-11-13T15:41:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-645",
"description": "CWE-645 Overly Restrictive Account Lockout Mechanism",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Zenitel",
"product": "Zenitel Connect",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.11.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.</p>"
}
]
}
],
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.11.0",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Upgrade to version 1.11.0</p>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reported by ZeroSubnet",
"type": "reporter"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/105xxx/CVE-2026-105625.json
+130
View File
@@ -0,0 +1,130 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105625",
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"state": "PUBLISHED",
"assignerShortName": "Zenitel",
"dateReserved": "2026-10-05T16:31:07.433Z",
"datePublished": "2026-11-13T15:39:12.569Z",
"dateUpdated": "2026-11-13T15:39:12.569Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel",
"dateUpdated": "2026-11-13T15:39:12.569Z"
},
"title": "Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction",
"datePublic": "2026-11-13T15:38:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-1021",
"description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Zenitel",
"product": "Zenitel Connect",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.11.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source."
}
]
}
],
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.11.0",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Upgrade to version 1.11.0</p>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reported by ZeroSubnet",
"type": "reporter"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/105xxx/CVE-2026-105671.json
+130
View File
@@ -0,0 +1,130 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-105671",
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"state": "PUBLISHED",
"assignerShortName": "Zenitel",
"dateReserved": "2026-10-05T17:24:32.718Z",
"datePublished": "2026-11-13T15:37:28.294Z",
"dateUpdated": "2026-11-13T15:37:28.294Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel",
"dateUpdated": "2026-11-13T15:37:28.294Z"
},
"title": "Zenitel Connect login allows username enumeration via verbose error responses",
"datePublic": "2026-11-13T15:36:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-204",
"description": "CWE-204 Observable Response Discrepancy",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Zenitel",
"product": "Zenitel Connect",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.11.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.</p>"
}
]
}
],
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 1.11.0",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Upgrade to version 1.11.0</p>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reported by ZeroSubnet",
"type": "reporter"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/107xxx/CVE-2026-107152.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-07T10:19:09.047Z",
"datePublished": "2026-11-12T20:04:09.664Z",
"dateUpdated": "2026-11-12T23:56:19.679Z"
"dateUpdated": "2026-11-13T15:38:20.935Z"
},
"containers": {
"cna": {
@@ -312,6 +312,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:38:13.405900Z",
"id": "CVE-2026-107152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:38:20.935Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107522.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-08T10:04:10.615Z",
"datePublished": "2026-11-13T14:59:55.571Z",
"dateUpdated": "2026-11-13T14:59:55.571Z"
"dateUpdated": "2026-11-13T16:11:50.819Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:00:38.249829Z",
"id": "CVE-2026-107522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:11:50.819Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107524.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-08T10:04:10.615Z",
"datePublished": "2026-11-13T14:30:19.045Z",
"dateUpdated": "2026-11-13T14:30:19.045Z"
"dateUpdated": "2026-11-13T15:50:10.830Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:50:04.163342Z",
"id": "CVE-2026-107524",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:50:10.830Z"
}
}
]
}
}
data/2026/109xxx/CVE-2026-109091.json
+209
View File
@@ -0,0 +1,209 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-109091",
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"state": "PUBLISHED",
"assignerShortName": "suse",
"dateReserved": "2026-10-12T06:41:23.778Z",
"datePublished": "2026-11-13T15:19:47.728Z",
"dateUpdated": "2026-11-13T16:07:23.755Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse",
"dateUpdated": "2026-11-13T15:20:46.237Z"
},
"title": "X.Org Server EDID DS_RANGES Out-Of-Bounds Write",
"datePublic": "2026-11-13T15:15:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"affected": [
{
"vendor": "X.Org",
"product": "xwayland",
"packageName": "xwayland",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.1.15",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "X.Org",
"product": "xorg-x11-server",
"packageName": "xorg-x11-server",
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "21.1.26",
"versionType": "rpm"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "24.1.15"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "21.1.26"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A buffer overflow in handling&nbsp;<span>EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.</span>"
}
]
}
],
"references": [
{
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4ab6e8d94222480c8d7a28f530334059e3ab7",
"tags": [
"patch"
]
},
{
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f0f7fdb2834c24feca63c0af5f46a57f4a04c",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"credits": [
{
"lang": "en",
"value": "Eun0us / Espilon <eun0us@espilon.net>",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:52:51.086125Z",
"id": "CVE-2026-109091",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:07:23.755Z"
}
}
]
}
}
data/2026/109xxx/CVE-2026-109095.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "suse",
"dateReserved": "2026-10-12T06:41:23.778Z",
"datePublished": "2026-11-13T13:53:11.592Z",
"dateUpdated": "2026-11-13T13:53:11.592Z"
"dateUpdated": "2026-11-13T16:15:07.445Z"
},
"containers": {
"cna": {
@@ -174,6 +174,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:05:55.156323Z",
"id": "CVE-2026-109095",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:15:07.445Z"
}
}
]
}
}
data/2026/110xxx/CVE-2026-110091.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-13T16:01:52.977Z",
"datePublished": "2026-11-10T20:25:59.164Z",
"dateUpdated": "2026-11-10T20:25:59.164Z"
"dateUpdated": "2026-11-13T15:54:41.352Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:52:15.152511Z",
"id": "CVE-2026-110091",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:54:41.352Z"
}
}
]
}
}
data/2026/111xxx/CVE-2026-111545.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-16T10:04:03.180Z",
"datePublished": "2026-11-13T15:15:45.253Z",
"dateUpdated": "2026-11-13T15:15:45.253Z"
"dateUpdated": "2026-11-13T15:46:08.479Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:45:58.779622Z",
"id": "CVE-2026-111545",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:46:08.479Z"
}
}
]
}
}
data/2026/111xxx/CVE-2026-111547.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-16T10:04:03.181Z",
"datePublished": "2026-11-13T14:40:14.978Z",
"dateUpdated": "2026-11-13T14:40:14.978Z"
"dateUpdated": "2026-11-13T16:13:50.727Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:02:23.012212Z",
"id": "CVE-2026-111547",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:13:50.727Z"
}
}
]
}
}
data/2026/113xxx/CVE-2026-113521.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-20T11:07:36.488Z",
"datePublished": "2026-11-10T20:36:45.815Z",
"dateUpdated": "2026-11-10T20:36:45.815Z"
"dateUpdated": "2026-11-13T16:03:56.160Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:03:34.749585Z",
"id": "CVE-2026-113521",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:03:56.160Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116412.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.242Z",
"datePublished": "2026-11-13T13:38:40.528Z",
"dateUpdated": "2026-11-13T13:38:40.528Z"
"dateUpdated": "2026-11-13T15:52:20.267Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:31:02.106080Z",
"id": "CVE-2026-116412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:52:20.267Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116413.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.242Z",
"datePublished": "2026-11-13T13:25:35.934Z",
"dateUpdated": "2026-11-13T13:25:35.934Z"
"dateUpdated": "2026-11-13T15:44:57.305Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:44:47.828120Z",
"id": "CVE-2026-116413",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:44:57.305Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116418.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T09:20:16.351Z",
"dateUpdated": "2026-11-13T09:20:16.351Z"
"dateUpdated": "2026-11-13T16:02:31.981Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:34:56.742807Z",
"id": "CVE-2026-116418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:31.981Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116422.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T08:48:51.501Z",
"dateUpdated": "2026-11-13T08:48:51.501Z"
"dateUpdated": "2026-11-13T15:52:24.895Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:52:16.242187Z",
"id": "CVE-2026-116422",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:52:24.895Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116423.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T08:39:13.728Z",
"dateUpdated": "2026-11-13T08:39:13.728Z"
"dateUpdated": "2026-11-13T15:55:17.658Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:55:07.617587Z",
"id": "CVE-2026-116423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:55:17.658Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116424.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T08:58:42.690Z",
"dateUpdated": "2026-11-13T08:58:42.690Z"
"dateUpdated": "2026-11-13T16:02:41.451Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:29:07.477284Z",
"id": "CVE-2026-116424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:41.451Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116426.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T08:36:05.678Z",
"dateUpdated": "2026-11-13T08:36:05.678Z"
"dateUpdated": "2026-11-13T16:02:49.020Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:29:04.716200Z",
"id": "CVE-2026-116426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:49.020Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116427.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T08:15:39.193Z",
"dateUpdated": "2026-11-13T08:15:39.193Z"
"dateUpdated": "2026-11-13T16:02:58.381Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:29:00.741438Z",
"id": "CVE-2026-116427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:58.381Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116431.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T09:05:36.362Z",
"dateUpdated": "2026-11-13T09:05:36.362Z"
"dateUpdated": "2026-11-13T15:56:19.297Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:56:07.662146Z",
"id": "CVE-2026-116431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:56:19.297Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116432.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T08:02:42.850Z",
"dateUpdated": "2026-11-13T08:02:42.850Z"
"dateUpdated": "2026-11-13T15:53:50.266Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:53:38.654948Z",
"id": "CVE-2026-116432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:53:50.266Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116509.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-26T13:13:50.719Z",
"datePublished": "2026-11-13T09:35:15.539Z",
"dateUpdated": "2026-11-13T09:35:15.539Z"
"dateUpdated": "2026-11-13T15:56:49.063Z"
},
"containers": {
"cna": {
@@ -98,6 +98,40 @@
"value": "Disclosed"
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:29:58.546107Z",
"id": "CVE-2026-116509",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:56:49.063Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119512.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T15:08:41.154Z",
"dateUpdated": "2026-11-13T15:08:41.154Z"
"dateUpdated": "2026-11-13T16:09:21.920Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:58:32.986323Z",
"id": "CVE-2026-119512",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:09:21.920Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119517.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T15:08:43.236Z",
"dateUpdated": "2026-11-13T15:08:43.236Z"
"dateUpdated": "2026-11-13T16:07:54.418Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:55:22.454803Z",
"id": "CVE-2026-119517",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:07:54.418Z"
}
}
]
}
}
data/2026/119xxx/CVE-2026-119518.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T13:03:21.131Z",
"dateUpdated": "2026-11-13T13:04:21.225Z"
"dateUpdated": "2026-11-13T15:52:28.736Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:30:59.552519Z",
"id": "CVE-2026-119518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:52:28.736Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120835.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T00:24:21.836Z",
"datePublished": "2026-11-13T15:08:40.812Z",
"dateUpdated": "2026-11-13T15:08:40.812Z"
"dateUpdated": "2026-11-13T16:09:36.392Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:58:46.355166Z",
"id": "CVE-2026-120835",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:09:36.392Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121721.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T21:24:31.789Z",
"datePublished": "2026-11-13T13:00:24.994Z",
"dateUpdated": "2026-11-13T13:01:26.322Z"
"dateUpdated": "2026-11-13T15:52:35.829Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:30:57.337561Z",
"id": "CVE-2026-121721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:52:35.829Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121776.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-04T00:24:30.154Z",
"datePublished": "2026-11-13T15:08:41.752Z",
"dateUpdated": "2026-11-13T15:08:41.752Z"
"dateUpdated": "2026-11-13T16:09:07.425Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:58:25.662966Z",
"id": "CVE-2026-121776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:09:07.425Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121808.json
+459
View File
@@ -0,0 +1,459 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-121808",
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"state": "PUBLISHED",
"assignerShortName": "EEF",
"dateReserved": "2026-11-09T22:35:50.462Z",
"datePublished": "2026-11-13T15:48:49.871Z",
"dateUpdated": "2026-11-13T15:48:49.871Z"
},
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Codec.Erlpack'"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Codec.Erlpack'"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "25bcc569fe2cc4478531a6c546c923205fc751c9",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Codec.Erlpack'"
],
"packageName": "grpc_core",
"packageURL": "pkg:hex/grpc_core",
"product": "grpc_core",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Codec.Erlpack'"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_core",
"programFiles": [
"grpc_core/lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "d6bc56ac75dfb6c02db2099909210a37c9be8db6",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p><code>GRPC.Codec.Erlpack</code> must be explicitly registered as a codec on the gRPC server.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server."
}
],
"value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jace"
},
{
"lang": "en",
"type": "finder",
"value": "zx"
},
{
"lang": "en",
"type": "reporter",
"value": "zx"
},
{
"lang": "en",
"type": "finder",
"value": "Jiacheng Zhong"
},
{
"lang": "en",
"type": "finder",
"value": "Zhun Wang"
},
{
"lang": "en",
"type": "finder",
"value": "Junmin Zhu"
},
{
"lang": "en",
"type": "finder",
"value": "Hongwei Li"
},
{
"lang": "en",
"type": "finder",
"value": "Han Dai"
},
{
"lang": "en",
"type": "finder",
"value": "Suyue Guo"
},
{
"lang": "en",
"type": "finder",
"value": "Songyang Peng"
},
{
"lang": "en",
"type": "finder",
"value": "Ziyue Pan"
},
{
"lang": "en",
"type": "reporter",
"value": "Hongwei Li"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan Männchen / EEF"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
}
],
"dateAssigned": "2026-11-12T20:11:46.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.</p>\n<p><code>GRPC.Codec.Erlpack.decode/2</code> (<code>grpc_core/lib/grpc/codec/erlpack.ex</code>, and <code>lib/grpc/codec/erlpack.ex</code> before the package split) passes the message body to <code>:erlang.binary_to_term/2</code>. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's <code>max_body_size</code> limit counts the compressed bytes of the request. A request with <code>Content-Type: application/grpc+erlpack</code> can therefore make the server allocate a term much larger than the request body.</p>\n<p>This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\n`GRPC.Codec.Erlpack.decode/2` (`grpc_core/lib/grpc/codec/erlpack.ex`, and `lib/grpc/codec/erlpack.ex` before the package split) passes the message body to `:erlang.binary_to_term/2`. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's `max_body_size` limit counts the compressed bytes of the request. A request with `Content-Type: application/grpc+erlpack` can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
}
],
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\nGRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
}
],
"value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-13T15:48:49.871Z"
},
"references": [
{
"name": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xxp9-7hp4-rqwp"
},
{
"name": "EEF CNA record for CVE-2026-121808",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-121808.html"
},
{
"name": "OSV record EEF-CVE-2026-121808",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-121808"
},
{
"name": "Introducing commit 25bcc56 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"
},
{
"name": "Fix commit 0332faa in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit d6bc56a in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Remove <code>GRPC.Codec.Erlpack</code> from the server's <code>codecs</code> list if the codec is not needed.</p>\n<p>If the codec is needed, register a wrapper codec in its place. The wrapper implements the <code>GRPC.Codec</code> behaviour, returns <code>\"erlpack\"</code> from <code>name/0</code>, raises in <code>decode/2</code> when the body starts with the bytes <code>131, 80</code> (the compressed term tag), and delegates all other calls to <code>GRPC.Codec.Erlpack</code>.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Remove `GRPC.Codec.Erlpack` from the server's `codecs` list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the `GRPC.Codec` behaviour, returns `\"erlpack\"` from `name/0`, raises in `decode/2` when the body starts with the bytes `131, 80` (the compressed term tag), and delegates all other calls to `GRPC.Codec.Erlpack`."
}
],
"value": "Remove GRPC.Codec.Erlpack from the server's codecs list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the GRPC.Codec behaviour, returns \"erlpack\" from name/0, raises in decode/2 when the body starts with the bytes 131, 80 (the compressed term tag), and delegates all other calls to GRPC.Codec.Erlpack."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<ol>\n<li>Start a gRPC server that registers <code>GRPC.Codec.Erlpack</code> in its <code>codecs</code> list.</li>\n<li>Build the payload with <code>:erlang.term_to_binary(:binary.copy(&lt;&lt;0&gt;&gt;, 268_435_456), [:compressed])</code>. The result is 260,932 bytes.</li>\n<li>Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with <code>Content-Type: application/grpc+erlpack</code>.</li>\n<li>Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback.</li>\n</ol>"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a gRPC server that registers `GRPC.Codec.Erlpack` in its `codecs` list.\n2. Build the payload with `:erlang.term_to_binary(:binary.copy(<<0>>, 268_435_456), [:compressed])`. The result is 260,932 bytes.\n3. Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with `Content-Type: application/grpc+erlpack`.\n4. Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
}
],
"value": "* Start a gRPC server that registers GRPC.Codec.Erlpack in its codecs list.\n* Build the payload with :erlang.term_to_binary(:binary.copy(<<0>>, 268_435_456), [:compressed]). The result is 260,932 bytes.\n* Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with Content-Type: application/grpc+erlpack.\n* Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p><strong>1. Codec selection</strong></p>\n<p>The server selects the codec from the request <code>Content-Type</code>. <code>application/grpc+erlpack</code> selects <code>GRPC.Codec.Erlpack</code> when the server registers it. No authentication step comes before this.</p>\n<p><strong>2. Size limit on compressed bytes only</strong></p>\n<p>The server limits the request body with <code>max_body_size</code>, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.</p>\n<p><strong>3. Expansion inside <code>binary_to_term/2</code></strong></p>\n<p><code>GRPC.Codec.Erlpack.decode/2</code> calls <code>:erlang.binary_to_term(binary, [:safe])</code>. The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). <code>binary_to_term/2</code> inflates it in full, and the <code>:safe</code> option does not limit the size. <code>ensure_safe_term!/1</code> runs after the call returns and accepts a large binary.</p>\n<p><strong>4. Result</strong></p>\n<p>In a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Codec selection**\n\nThe server selects the codec from the request `Content-Type`. `application/grpc+erlpack` selects `GRPC.Codec.Erlpack` when the server registers it. No authentication step comes before this.\n\n**2. Size limit on compressed bytes only**\n\nThe server limits the request body with `max_body_size`, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n**3. Expansion inside `binary_to_term/2`**\n\n`GRPC.Codec.Erlpack.decode/2` calls `:erlang.binary_to_term(binary, [:safe])`. The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). `binary_to_term/2` inflates it in full, and the `:safe` option does not limit the size. `ensure_safe_term!/1` runs after the call returns and accepts a large binary.\n\n**4. Result**\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
}
],
"value": "1. Codec selection\n\nThe server selects the codec from the request Content-Type. application/grpc+erlpack selects GRPC.Codec.Erlpack when the server registers it. No authentication step comes before this.\n\n2. Size limit on compressed bytes only\n\nThe server limits the request body with max_body_size, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n3. Expansion inside binary_to_term/2\n\nGRPC.Codec.Erlpack.decode/2 calls :erlang.binary_to_term(binary, [:safe]). The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). binary_to_term/2 inflates it in full, and the :safe option does not limit the size. ensure_safe_term!/1 runs after the call returns and accepts a large binary.\n\n4. Result\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
}
]
}
}
}
data/2026/123xxx/CVE-2026-123635.json
+329
View File
@@ -0,0 +1,329 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123635",
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"state": "PUBLISHED",
"assignerShortName": "EEF",
"dateReserved": "2026-11-09T22:27:54.995Z",
"datePublished": "2026-11-13T15:40:16.288Z",
"dateUpdated": "2026-11-13T15:40:16.288Z"
},
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"grpc_stream_h"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"src/grpc_stream_h.erl"
],
"programRoutines": [
{
"name": "grpc_stream_h:init/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"grpc_stream_h"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/src/grpc_stream_h.erl"
],
"programRoutines": [
{
"name": "grpc_stream_h:init/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "61a71948e6e7b95efb27d48e7084c764503cc802",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
}
],
"value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Aaron Lovi"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Lovi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan Männchen / EEF"
}
],
"dateAssigned": "2026-11-12T20:33:14.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.</p>\n<p>The stream handler <code>grpc_stream_h</code> (<code>grpc_server/src/grpc_stream_h.erl</code>) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds <code>max_body_size</code> or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.</p>\n<p>This issue affects grpc_server: from 1.0.0 before 1.1.0.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler `grpc_stream_h` (`grpc_server/src/grpc_stream_h.erl`) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds `max_body_size` or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-131",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
}
],
"value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-13T15:40:16.288Z"
},
"references": [
{
"name": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr"
},
{
"name": "EEF CNA record for CVE-2026-123635",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-123635.html"
},
{
"name": "OSV record EEF-CVE-2026-123635",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-123635"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 61a7194 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Put a Cowboy stream handler in front of <code>grpc_stream_h</code> with the adapter option <code>stream_handlers: [MyHandler, :grpc_stream_h]</code>. In <code>init/3</code>, the handler calls <code>:cowboy_stream.init/3</code> and adds a <code>{:flow, size}</code> command when the request has a body, where <code>size</code> is Cowboy's <code>max_frame_size_received</code> (16384 by default). It passes all other callbacks to <code>:cowboy_stream</code>.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Put a Cowboy stream handler in front of `grpc_stream_h` with the adapter option `stream_handlers: [MyHandler, :grpc_stream_h]`. In `init/3`, the handler calls `:cowboy_stream.init/3` and adds a `{:flow, size}` command when the request has a body, where `size` is Cowboy's `max_frame_size_received` (16384 by default). It passes all other callbacks to `:cowboy_stream`."
}
],
"value": "Put a Cowboy stream handler in front of grpc_stream_h with the adapter option stream_handlers: [MyHandler, :grpc_stream_h]. In init/3, the handler calls :cowboy_stream.init/3 and adds a {:flow, size} command when the request has a body, where size is Cowboy's max_frame_size_received (16384 by default). It passes all other callbacks to :cowboy_stream."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<ol>\n<li>Start a gRPC server with a small <code>max_body_size</code>, for example 1000 bytes.</li>\n<li>Open one HTTP/2 connection with a client that tracks the connection window.</li>\n<li>Send a unary call with a body above the limit and wait for the <code>RESOURCE_EXHAUSTED</code> reply.</li>\n<li>Send more DATA frames on the refused stream, up to what the stream and connection windows allow.</li>\n<li>Repeat steps 3 and 4 on new streams until the connection window is 0.</li>\n<li>Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline.</li>\n</ol>"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a gRPC server with a small `max_body_size`, for example 1000 bytes.\n2. Open one HTTP/2 connection with a client that tracks the connection window.\n3. Send a unary call with a body above the limit and wait for the `RESOURCE_EXHAUSTED` reply.\n4. Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n5. Repeat steps 3 and 4 on new streams until the connection window is 0.\n6. Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
}
],
"value": "* Start a gRPC server with a small max_body_size, for example 1000 bytes.\n* Open one HTTP/2 connection with a client that tracks the connection window.\n* Send a unary call with a body above the limit and wait for the RESOURCE_EXHAUSTED reply.\n* Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n* Repeat steps 3 and 4 on new streams until the connection window is 0.\n* Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p><strong>1. Flow is requested only for data that arrived</strong></p>\n<p>Cowboy increases the HTTP/2 connection window only when a stream handler returns a <code>{flow, N}</code> command. <code>grpc_stream_h</code> returns that command only for request data it has received.</p>\n<p><strong>2. A refused call leaves data uncredited</strong></p>\n<p>When the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level <code>WINDOW_UPDATE</code> is sent.</p>\n<p><strong>3. The window empties</strong></p>\n<p>Each refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.</p>\n<p><strong>4. Result</strong></p>\n<p>Every later call on the connection that has a request body waits until its deadline. A new connection works normally.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Flow is requested only for data that arrived**\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a `{flow, N}` command. `grpc_stream_h` returns that command only for request data it has received.\n\n**2. A refused call leaves data uncredited**\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level `WINDOW_UPDATE` is sent.\n\n**3. The window empties**\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n**4. Result**\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
}
],
"value": "1. Flow is requested only for data that arrived\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a {flow, N} command. grpc_stream_h returns that command only for request data it has received.\n\n2. A refused call leaves data uncredited\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level WINDOW_UPDATE is sent.\n\n3. The window empties\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n4. Result\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
}
]
}
}
}
data/2026/124xxx/CVE-2026-124260.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:41.519Z",
"dateUpdated": "2026-11-13T15:08:41.519Z"
"dateUpdated": "2026-11-13T15:58:32.121Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:10.752107Z",
"id": "CVE-2026-124260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:58:32.121Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124265.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:42.588Z",
"dateUpdated": "2026-11-13T15:08:42.588Z"
"dateUpdated": "2026-11-13T16:08:23.954Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:35.862751Z",
"id": "CVE-2026-124265",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:08:23.954Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124267.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:42.065Z",
"dateUpdated": "2026-11-13T15:08:42.065Z"
"dateUpdated": "2026-11-13T16:08:52.884Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:57.590818Z",
"id": "CVE-2026-124267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:08:52.884Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124272.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.636Z",
"datePublished": "2026-11-13T15:08:41.860Z",
"dateUpdated": "2026-11-13T15:08:41.860Z"
"dateUpdated": "2026-11-13T15:58:17.174Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:07.889270Z",
"id": "CVE-2026-124272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:58:17.174Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124278.json
+421
View File
@@ -0,0 +1,421 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124278",
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"state": "PUBLISHED",
"assignerShortName": "EEF",
"dateReserved": "2026-11-09T23:03:52.038Z",
"datePublished": "2026-11-13T15:58:08.134Z",
"dateUpdated": "2026-11-13T15:58:08.134Z"
},
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Server'",
"'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Server':do_handle_request/4"
},
{
"name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Server'",
"'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server.ex",
"grpc_server/lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Server':do_handle_request/4"
},
{
"name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "953ab980d8a127e895d3ab9505fc4b9337bb32f7",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Server'",
"'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Server':do_handle_request/4"
},
{
"name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.GRPC.Server'",
"'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "'Elixir.GRPC.Server':do_handle_request/4"
},
{
"name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>HTTP-to-gRPC transcoding must be enabled with <code>http_transcode: true</code>. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "HTTP-to-gRPC transcoding must be enabled with `http_transcode: true`. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
}
],
"value": "HTTP-to-gRPC transcoding must be enabled with http_transcode: true. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "finder",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan Männchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:18:41.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.</p>\n<p>Only the transcoding clause of <code>GRPC.Server.do_handle_request/4</code> (<code>grpc_server/lib/grpc/server.ex</code>, and <code>lib/grpc/server.ex</code> before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request <code>Content-Type</code>, not from the route. A request to a transcoded URL with <code>application/grpc</code> or <code>application/grpc-web</code> is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.</p>\n<p>This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of `GRPC.Server.do_handle_request/4` (`grpc_server/lib/grpc/server.ex`, and `lib/grpc/server.ex` before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request `Content-Type`, not from the route. A request to a transcoded URL with `application/grpc` or `application/grpc-web` is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-460",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data."
}
],
"value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436 Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-13T15:58:08.134Z"
},
"references": [
{
"name": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m"
},
{
"name": "EEF CNA record for CVE-2026-124278",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-124278.html"
},
{
"name": "OSV record EEF-CVE-2026-124278",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-124278"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 953ab98 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7"
},
{
"name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<ol>\n<li>Start a server with <code>http_transcode: true</code> and a transcoded route that binds a field from the path, for example <code>GET /v1/messages/{name}</code>.</li>\n<li>Build a gRPC frame whose message sets <code>name</code> to <code>victim</code>.</li>\n<li>Send it over HTTP/1.1 as <code>GET /v1/messages/alice</code> with <code>Content-Type: application/grpc</code>.</li>\n<li>Observe that the handler receives <code>name</code> set to <code>victim</code>, not <code>alice</code>.</li>\n</ol>"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a server with `http_transcode: true` and a transcoded route that binds a field from the path, for example `GET /v1/messages/{name}`.\n2. Build a gRPC frame whose message sets `name` to `victim`.\n3. Send it over HTTP/1.1 as `GET /v1/messages/alice` with `Content-Type: application/grpc`.\n4. Observe that the handler receives `name` set to `victim`, not `alice`."
}
],
"value": "* Start a server with http_transcode: true and a transcoded route that binds a field from the path, for example GET /v1/messages/{name}.\n* Build a gRPC frame whose message sets name to victim.\n* Send it over HTTP/1.1 as GET /v1/messages/alice with Content-Type: application/grpc.\n* Observe that the handler receives name set to victim, not alice."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p><strong>1. The header selects the clause</strong></p>\n<p>The Cowboy handler derives the access mode from the request <code>Content-Type</code>. <code>application/json</code> selects <code>:http_transcoding</code>, <code>application/grpc</code> selects <code>:grpc</code> and <code>application/grpc-web+proto</code> selects <code>:grpcweb</code>. The router still matches the transcoded URL template and extracts its path bindings.</p>\n<p><strong>2. Bindings are applied in one clause only</strong></p>\n<p><code>GRPC.Server.do_handle_request/4</code> reads the bindings with <code>adapter.get_bindings/1</code> and merges them through <code>GRPC.Server.Transcode.map_request/5</code> only in the <code>:http_transcoding</code> clause. The unary and request-streaming clauses decode the body alone with the selected codec. <code>GRPC.Codec.Proto</code> is in the default codecs of every server, so <code>application/grpc</code> is always accepted.</p>\n<p><strong>3. The HTTP/1.1 guard never matches</strong></p>\n<p><code>resolve_access_mode/3</code> has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary <code>\"HTTP/1.1\"</code>, while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.</p>\n<p><strong>4. Result</strong></p>\n<p>A request to <code>/v1/messages/alice</code> with <code>Content-Type: application/grpc</code> and a message that sets <code>name</code> to <code>victim</code> reaches the handler with <code>name</code> set to <code>victim</code>. With an empty message the field is empty: the path binding is never consulted.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. The header selects the clause**\n\nThe Cowboy handler derives the access mode from the request `Content-Type`. `application/json` selects `:http_transcoding`, `application/grpc` selects `:grpc` and `application/grpc-web+proto` selects `:grpcweb`. The router still matches the transcoded URL template and extracts its path bindings.\n\n**2. Bindings are applied in one clause only**\n\n`GRPC.Server.do_handle_request/4` reads the bindings with `adapter.get_bindings/1` and merges them through `GRPC.Server.Transcode.map_request/5` only in the `:http_transcoding` clause. The unary and request-streaming clauses decode the body alone with the selected codec. `GRPC.Codec.Proto` is in the default codecs of every server, so `application/grpc` is always accepted.\n\n**3. The HTTP/1.1 guard never matches**\n\n`resolve_access_mode/3` has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary `\"HTTP/1.1\"`, while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n**4. Result**\n\nA request to `/v1/messages/alice` with `Content-Type: application/grpc` and a message that sets `name` to `victim` reaches the handler with `name` set to `victim`. With an empty message the field is empty: the path binding is never consulted."
}
],
"value": "1. The header selects the clause\n\nThe Cowboy handler derives the access mode from the request Content-Type. application/json selects :http_transcoding, application/grpc selects :grpc and application/grpc-web+proto selects :grpcweb. The router still matches the transcoded URL template and extracts its path bindings.\n\n2. Bindings are applied in one clause only\n\nGRPC.Server.do_handle_request/4 reads the bindings with adapter.get_bindings/1 and merges them through GRPC.Server.Transcode.map_request/5 only in the :http_transcoding clause. The unary and request-streaming clauses decode the body alone with the selected codec. GRPC.Codec.Proto is in the default codecs of every server, so application/grpc is always accepted.\n\n3. The HTTP/1.1 guard never matches\n\nresolve_access_mode/3 has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \"HTTP/1.1\", while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n4. Result\n\nA request to /v1/messages/alice with Content-Type: application/grpc and a message that sets name to victim reaches the handler with name set to victim. With an empty message the field is empty: the path binding is never consulted."
}
]
}
}
}
data/2026/124xxx/CVE-2026-124409.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T14:39:29.907Z",
"dateUpdated": "2026-11-13T14:40:31.659Z"
"dateUpdated": "2026-11-13T16:14:06.743Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:02:33.694825Z",
"id": "CVE-2026-124409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:14:06.743Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124410.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:42.902Z",
"dateUpdated": "2026-11-13T15:08:42.902Z"
"dateUpdated": "2026-11-13T15:57:27.854Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:56:58.734777Z",
"id": "CVE-2026-124410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:57:27.854Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124414.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:42.440Z",
"dateUpdated": "2026-11-13T15:08:42.440Z"
"dateUpdated": "2026-11-13T16:08:38.407Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:44.222208Z",
"id": "CVE-2026-124414",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:08:38.407Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124415.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:43.121Z",
"dateUpdated": "2026-11-13T15:08:43.121Z"
"dateUpdated": "2026-11-13T16:08:09.467Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:55:15.857880Z",
"id": "CVE-2026-124415",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:08:09.467Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124418.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.331Z",
"datePublished": "2026-11-13T15:08:42.240Z",
"dateUpdated": "2026-11-13T15:08:42.240Z"
"dateUpdated": "2026-11-13T15:58:02.199Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:04.968268Z",
"id": "CVE-2026-124418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:58:02.199Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124420.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.331Z",
"datePublished": "2026-11-13T15:08:41.418Z",
"dateUpdated": "2026-11-13T15:08:41.418Z"
"dateUpdated": "2026-11-13T15:58:49.170Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:13.388977Z",
"id": "CVE-2026-124420",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:58:49.170Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124965.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T15:06:57.634Z",
"datePublished": "2026-11-13T15:08:42.786Z",
"dateUpdated": "2026-11-13T15:08:42.786Z"
"dateUpdated": "2026-11-13T15:57:45.624Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:01.597861Z",
"id": "CVE-2026-124965",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:57:45.624Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124970.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T15:12:36.503Z",
"datePublished": "2026-11-13T15:08:40.764Z",
"dateUpdated": "2026-11-13T15:08:40.764Z"
"dateUpdated": "2026-11-13T16:09:50.894Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:59:12.219833Z",
"id": "CVE-2026-124970",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:09:50.894Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125122.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T17:45:35.936Z",
"datePublished": "2026-11-10T16:50:46.826Z",
"dateUpdated": "2026-11-10T16:50:46.826Z"
"dateUpdated": "2026-11-13T15:25:23.463Z"
},
"containers": {
"cna": {
@@ -113,6 +113,40 @@
"advisory": "GHSA-hr4h-4c45-v4q4",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:25:03.488776Z",
"id": "CVE-2026-125122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:25:23.463Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125320.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.597Z",
"datePublished": "2026-11-10T17:23:43.734Z",
"dateUpdated": "2026-11-10T17:23:43.734Z"
"dateUpdated": "2026-11-13T15:31:58.504Z"
},
"containers": {
"cna": {
@@ -107,6 +107,40 @@
"advisory": "GHSA-6hg5-9f3w-c886",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:31:40.892443Z",
"id": "CVE-2026-125320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:31:58.504Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125325.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.597Z",
"datePublished": "2026-11-10T17:58:40.428Z",
"dateUpdated": "2026-11-10T17:58:40.428Z"
"dateUpdated": "2026-11-13T15:33:27.769Z"
},
"containers": {
"cna": {
@@ -110,6 +110,40 @@
"advisory": "GHSA-w437-9mwm-j6vq",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:33:16.391558Z",
"id": "CVE-2026-125325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:33:27.769Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125328.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.598Z",
"datePublished": "2026-11-10T18:05:20.491Z",
"dateUpdated": "2026-11-10T18:05:20.491Z"
"dateUpdated": "2026-11-13T15:34:20.583Z"
},
"containers": {
"cna": {
@@ -117,6 +117,40 @@
"advisory": "GHSA-8835-xmqj-354h",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:33:59.094273Z",
"id": "CVE-2026-125328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:34:20.583Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125336.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.599Z",
"datePublished": "2026-11-10T18:52:37.915Z",
"dateUpdated": "2026-11-10T18:52:37.915Z"
"dateUpdated": "2026-11-13T15:41:15.447Z"
},
"containers": {
"cna": {
@@ -107,6 +107,48 @@
"advisory": "GHSA-3cc4-3294-vgjf",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-3cc4-3294-vgjf",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:38:29.973125Z",
"id": "CVE-2026-125336",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:41:15.447Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125340.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.599Z",
"datePublished": "2026-11-10T20:07:15.283Z",
"dateUpdated": "2026-11-10T20:07:15.283Z"
"dateUpdated": "2026-11-13T15:44:37.421Z"
},
"containers": {
"cna": {
@@ -93,6 +93,40 @@
"advisory": "GHSA-hq84-x37p-j6q5",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:42:01.267953Z",
"id": "CVE-2026-125340",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:44:37.421Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125402.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:15.846Z",
"datePublished": "2026-11-09T23:28:04.231Z",
"dateUpdated": "2026-11-09T23:28:04.231Z"
"dateUpdated": "2026-11-13T16:14:38.283Z"
},
"containers": {
"cna": {
@@ -160,6 +160,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:12:39.401109Z",
"id": "CVE-2026-125402",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:14:38.283Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125432.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.520Z",
"datePublished": "2026-11-13T15:08:43.468Z",
"dateUpdated": "2026-11-13T15:08:43.468Z"
"dateUpdated": "2026-11-13T16:07:38.892Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:55:03.486970Z",
"id": "CVE-2026-125432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:07:38.892Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125452.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.522Z",
"datePublished": "2026-11-13T15:08:38.883Z",
"dateUpdated": "2026-11-13T15:08:38.883Z"
"dateUpdated": "2026-11-13T16:00:13.064Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:29.351299Z",
"id": "CVE-2026-125452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:00:13.064Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125755.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T12:36:09.129Z",
"datePublished": "2026-11-10T15:22:50.055Z",
"dateUpdated": "2026-11-10T15:22:50.055Z"
"dateUpdated": "2026-11-13T15:21:26.856Z"
},
"containers": {
"cna": {
@@ -155,6 +155,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:20:34.361781Z",
"id": "CVE-2026-125755",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:21:26.856Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125759.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T12:36:10.513Z",
"datePublished": "2026-11-10T15:22:52.910Z",
"dateUpdated": "2026-11-10T15:22:52.910Z"
"dateUpdated": "2026-11-13T15:22:46.074Z"
},
"containers": {
"cna": {
@@ -145,6 +145,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:22:17.927198Z",
"id": "CVE-2026-125759",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:22:46.074Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125783.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.984Z",
"datePublished": "2026-11-13T15:08:41.100Z",
"dateUpdated": "2026-11-13T15:08:41.100Z"
"dateUpdated": "2026-11-13T15:59:07.746Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:16.594692Z",
"id": "CVE-2026-125783",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:59:07.746Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125785.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.984Z",
"datePublished": "2026-11-12T00:12:02.005Z",
"dateUpdated": "2026-11-12T00:13:02.392Z"
"dateUpdated": "2026-11-13T16:02:55.705Z"
},
"containers": {
"cna": {
@@ -131,6 +131,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:58:07.780687Z",
"id": "CVE-2026-125785",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:55.705Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125792.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.985Z",
"datePublished": "2026-11-13T14:44:46.614Z",
"dateUpdated": "2026-11-13T14:45:47.454Z"
"dateUpdated": "2026-11-13T16:12:36.770Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:01:11.559797Z",
"id": "CVE-2026-125792",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:12:36.770Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125794.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.985Z",
"datePublished": "2026-11-13T14:45:32.012Z",
"dateUpdated": "2026-11-13T14:46:32.964Z"
"dateUpdated": "2026-11-13T16:00:29.538Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:32.702748Z",
"id": "CVE-2026-125794",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:00:29.538Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125800.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.986Z",
"datePublished": "2026-11-13T13:16:41.564Z",
"dateUpdated": "2026-11-13T13:16:41.564Z"
"dateUpdated": "2026-11-13T16:02:08.217Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:54.634774Z",
"id": "CVE-2026-125800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:08.217Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125802.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.986Z",
"datePublished": "2026-11-13T14:49:06.308Z",
"dateUpdated": "2026-11-13T14:49:06.755Z"
"dateUpdated": "2026-11-13T16:12:07.839Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:00:23.483315Z",
"id": "CVE-2026-125802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:12:07.839Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125807.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.987Z",
"datePublished": "2026-11-13T14:38:08.242Z",
"dateUpdated": "2026-11-13T14:38:08.621Z"
"dateUpdated": "2026-11-13T16:01:35.627Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:46.426054Z",
"id": "CVE-2026-125807",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:01:35.627Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125808.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.987Z",
"datePublished": "2026-11-13T14:37:19.654Z",
"dateUpdated": "2026-11-13T14:37:26.063Z"
"dateUpdated": "2026-11-13T16:14:21.250Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:02:41.586919Z",
"id": "CVE-2026-125808",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:14:21.250Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125809.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:41:21.896Z",
"dateUpdated": "2026-11-13T14:42:22.792Z"
"dateUpdated": "2026-11-13T16:01:02.102Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:39.753613Z",
"id": "CVE-2026-125809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:01:02.102Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125810.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:41:40.114Z",
"dateUpdated": "2026-11-13T14:42:41.233Z"
"dateUpdated": "2026-11-13T16:13:36.278Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:01:44.238778Z",
"id": "CVE-2026-125810",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:13:36.278Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125811.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:42:07.515Z",
"dateUpdated": "2026-11-13T14:43:08.685Z"
"dateUpdated": "2026-11-13T16:13:21.838Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:01:37.061482Z",
"id": "CVE-2026-125811",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:13:21.838Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125816.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.989Z",
"datePublished": "2026-11-13T13:03:44.155Z",
"dateUpdated": "2026-11-13T13:04:43.817Z"
"dateUpdated": "2026-11-13T16:02:24.218Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:58.902733Z",
"id": "CVE-2026-125816",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:24.218Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125819.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.989Z",
"datePublished": "2026-11-13T14:36:42.484Z",
"dateUpdated": "2026-11-13T14:37:43.070Z"
"dateUpdated": "2026-11-13T16:14:35.758Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:03:39.726191Z",
"id": "CVE-2026-125819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:14:35.758Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125824.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:37:01.016Z",
"dateUpdated": "2026-11-13T14:38:01.756Z"
"dateUpdated": "2026-11-13T16:01:51.146Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:51.066926Z",
"id": "CVE-2026-125824",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:01:51.146Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125825.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:48:42.721Z",
"dateUpdated": "2026-11-13T14:49:43.300Z"
"dateUpdated": "2026-11-13T16:12:22.283Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:00:47.482919Z",
"id": "CVE-2026-125825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:12:22.283Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125827.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:42:34.956Z",
"dateUpdated": "2026-11-13T14:43:36.205Z"
"dateUpdated": "2026-11-13T16:13:07.517Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:01:29.042417Z",
"id": "CVE-2026-125827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:13:07.517Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125831.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:44:06.958Z",
"dateUpdated": "2026-11-13T14:45:08.045Z"
"dateUpdated": "2026-11-13T16:00:45.599Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:35.545065Z",
"id": "CVE-2026-125831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:00:45.599Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125833.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T12:56:11.234Z",
"dateUpdated": "2026-11-13T12:57:11.726Z"
"dateUpdated": "2026-11-13T16:02:39.742Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:58:03.770972Z",
"id": "CVE-2026-125833",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:02:39.742Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125834.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T14:43:27.039Z",
"dateUpdated": "2026-11-13T14:44:28.214Z"
"dateUpdated": "2026-11-13T16:12:51.780Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:01:20.262708Z",
"id": "CVE-2026-125834",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:12:51.780Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125835.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T14:39:51.449Z",
"dateUpdated": "2026-11-13T14:40:53.481Z"
"dateUpdated": "2026-11-13T16:01:19.159Z"
},
"containers": {
"cna": {
@@ -131,6 +131,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:43.302732Z",
"id": "CVE-2026-125835",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:01:19.159Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125837.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T15:08:39.612Z",
"dateUpdated": "2026-11-13T15:08:39.612Z"
"dateUpdated": "2026-11-13T15:59:55.766Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:26.244626Z",
"id": "CVE-2026-125837",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:59:55.766Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125851.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:40.381Z",
"dateUpdated": "2026-11-13T15:08:40.381Z"
"dateUpdated": "2026-11-13T16:10:07.428Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:59:04.214993Z",
"id": "CVE-2026-125851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:10:07.428Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125852.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.232Z",
"dateUpdated": "2026-11-13T15:08:39.232Z"
"dateUpdated": "2026-11-13T16:11:06.410Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:59:48.778974Z",
"id": "CVE-2026-125852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:11:06.410Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125853.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.265Z",
"dateUpdated": "2026-11-13T15:08:39.265Z"
"dateUpdated": "2026-11-13T16:10:50.924Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:59:41.778917Z",
"id": "CVE-2026-125853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:10:50.924Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125854.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.982Z",
"dateUpdated": "2026-11-13T15:08:39.982Z"
"dateUpdated": "2026-11-13T15:59:39.273Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:22.667228Z",
"id": "CVE-2026-125854",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:59:39.273Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125855.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.659Z",
"dateUpdated": "2026-11-13T15:08:39.659Z"
"dateUpdated": "2026-11-13T16:10:36.398Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:59:31.214808Z",
"id": "CVE-2026-125855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:10:36.398Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125856.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:40.002Z",
"dateUpdated": "2026-11-13T15:08:40.002Z"
"dateUpdated": "2026-11-13T15:59:23.285Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:57:19.153570Z",
"id": "CVE-2026-125856",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:59:23.285Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125858.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:40.361Z",
"dateUpdated": "2026-11-13T15:08:40.361Z"
"dateUpdated": "2026-11-13T16:10:21.907Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:59:21.543049Z",
"id": "CVE-2026-125858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:10:21.907Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126049.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T16:53:12.633Z",
"datePublished": "2026-11-10T16:58:04.296Z",
"dateUpdated": "2026-11-10T16:58:04.296Z"
"dateUpdated": "2026-11-13T15:27:55.046Z"
},
"containers": {
"cna": {
@@ -137,6 +137,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:27:41.189264Z",
"id": "CVE-2026-126049",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:27:55.046Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126063.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.283Z",
"datePublished": "2026-11-10T20:14:40.408Z",
"dateUpdated": "2026-11-10T20:14:40.408Z"
"dateUpdated": "2026-11-13T15:51:43.029Z"
},
"containers": {
"cna": {
@@ -120,6 +120,40 @@
"advisory": "GHSA-4p39-36wj-23h4",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:49:25.822174Z",
"id": "CVE-2026-126063",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:51:43.029Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126067.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.283Z",
"datePublished": "2026-11-10T20:29:44.430Z",
"dateUpdated": "2026-11-10T20:29:44.430Z"
"dateUpdated": "2026-11-13T16:00:26.328Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-gmj8-hvj3-49mw",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:56:36.588222Z",
"id": "CVE-2026-126067",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:00:26.328Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126071.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.284Z",
"datePublished": "2026-11-10T20:40:37.197Z",
"dateUpdated": "2026-11-10T20:40:37.197Z"
"dateUpdated": "2026-11-13T16:07:47.057Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-4v2w-w6g6-f8f8",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:05:22.732996Z",
"id": "CVE-2026-126071",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:07:47.057Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126074.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.284Z",
"datePublished": "2026-11-10T20:48:25.207Z",
"dateUpdated": "2026-11-10T20:48:25.207Z"
"dateUpdated": "2026-11-13T16:08:25.577Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-p2pm-g2h6-7j5j",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:08:01.643343Z",
"id": "CVE-2026-126074",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:08:25.577Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126079.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.285Z",
"datePublished": "2026-11-10T21:02:30.667Z",
"dateUpdated": "2026-11-10T21:02:30.667Z"
"dateUpdated": "2026-11-13T16:12:01.279Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-2p2f-4rq4-gjwc",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T16:11:45.399950Z",
"id": "CVE-2026-126079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T16:12:01.279Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126274.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.971Z",
"datePublished": "2026-11-13T09:36:44.396Z",
"dateUpdated": "2026-11-13T09:36:44.396Z"
"dateUpdated": "2026-11-13T15:53:19.105Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:35:37.552966Z",
"id": "CVE-2026-126274",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:53:19.105Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126282.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:37.841Z",
"dateUpdated": "2026-11-13T09:36:37.841Z"
"dateUpdated": "2026-11-13T15:53:26.198Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:35:35.354163Z",
"id": "CVE-2026-126282",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:53:26.198Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126290.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:32.519Z",
"dateUpdated": "2026-11-13T09:36:32.519Z"
"dateUpdated": "2026-11-13T15:53:32.854Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T15:30:47.817569Z",
"id": "CVE-2026-126290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T15:53:32.854Z"
}
}
]
}
}
Loaded 100 of 226 files, more files were not shown because too many files have changed in this diff. Show more