The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.
"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "LOW",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.9,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to version 1.11.0",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "NONE",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "LOW",
+ "subAvailabilityImpact": "NONE",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.9,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to version 1.11.0",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "LOW",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.9,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to version 1.11.0",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "",
+ "type": "finder"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "x_generator": {
+ "engine": "Vulnogram 1.0.5"
+ }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:52:51.086125Z",
+ "id": "CVE-2026-109091",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:07:23.755Z"
+ }
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/data/2026/109xxx/CVE-2026-109095.json b/data/2026/109xxx/CVE-2026-109095.json
index 948b2cb537..242b78ee77 100644
--- a/data/2026/109xxx/CVE-2026-109095.json
+++ b/data/2026/109xxx/CVE-2026-109095.json
@@ -8,7 +8,7 @@
"assignerShortName": "suse",
"dateReserved": "2026-10-12T06:41:23.778Z",
"datePublished": "2026-11-13T13:53:11.592Z",
- "dateUpdated": "2026-11-13T13:53:11.592Z"
+ "dateUpdated": "2026-11-13T16:15:07.445Z"
},
"containers": {
"cna": {
@@ -174,6 +174,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:05:55.156323Z",
+ "id": "CVE-2026-109095",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:15:07.445Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/110xxx/CVE-2026-110091.json b/data/2026/110xxx/CVE-2026-110091.json
index 5db5be4eae..acf5f62945 100644
--- a/data/2026/110xxx/CVE-2026-110091.json
+++ b/data/2026/110xxx/CVE-2026-110091.json
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-13T16:01:52.977Z",
"datePublished": "2026-11-10T20:25:59.164Z",
- "dateUpdated": "2026-11-10T20:25:59.164Z"
+ "dateUpdated": "2026-11-13T15:54:41.352Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:52:15.152511Z",
+ "id": "CVE-2026-110091",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:41.352Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/111xxx/CVE-2026-111545.json b/data/2026/111xxx/CVE-2026-111545.json
index 77289003f3..5f76635556 100644
--- a/data/2026/111xxx/CVE-2026-111545.json
+++ b/data/2026/111xxx/CVE-2026-111545.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-16T10:04:03.180Z",
"datePublished": "2026-11-13T15:15:45.253Z",
- "dateUpdated": "2026-11-13T15:15:45.253Z"
+ "dateUpdated": "2026-11-13T15:46:08.479Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:45:58.779622Z",
+ "id": "CVE-2026-111545",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:46:08.479Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/111xxx/CVE-2026-111547.json b/data/2026/111xxx/CVE-2026-111547.json
index 97c292c634..10148719e6 100644
--- a/data/2026/111xxx/CVE-2026-111547.json
+++ b/data/2026/111xxx/CVE-2026-111547.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-16T10:04:03.181Z",
"datePublished": "2026-11-13T14:40:14.978Z",
- "dateUpdated": "2026-11-13T14:40:14.978Z"
+ "dateUpdated": "2026-11-13T16:13:50.727Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:02:23.012212Z",
+ "id": "CVE-2026-111547",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:13:50.727Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/113xxx/CVE-2026-113521.json b/data/2026/113xxx/CVE-2026-113521.json
index 4414fdbd73..0050e27d59 100644
--- a/data/2026/113xxx/CVE-2026-113521.json
+++ b/data/2026/113xxx/CVE-2026-113521.json
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-20T11:07:36.488Z",
"datePublished": "2026-11-10T20:36:45.815Z",
- "dateUpdated": "2026-11-10T20:36:45.815Z"
+ "dateUpdated": "2026-11-13T16:03:56.160Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:03:34.749585Z",
+ "id": "CVE-2026-113521",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:03:56.160Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116412.json b/data/2026/116xxx/CVE-2026-116412.json
index 2738868348..a2d24cfdbb 100644
--- a/data/2026/116xxx/CVE-2026-116412.json
+++ b/data/2026/116xxx/CVE-2026-116412.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.242Z",
"datePublished": "2026-11-13T13:38:40.528Z",
- "dateUpdated": "2026-11-13T13:38:40.528Z"
+ "dateUpdated": "2026-11-13T15:52:20.267Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:31:02.106080Z",
+ "id": "CVE-2026-116412",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:52:20.267Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116413.json b/data/2026/116xxx/CVE-2026-116413.json
index b646876db2..fe09ccbc73 100644
--- a/data/2026/116xxx/CVE-2026-116413.json
+++ b/data/2026/116xxx/CVE-2026-116413.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.242Z",
"datePublished": "2026-11-13T13:25:35.934Z",
- "dateUpdated": "2026-11-13T13:25:35.934Z"
+ "dateUpdated": "2026-11-13T15:44:57.305Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:44:47.828120Z",
+ "id": "CVE-2026-116413",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:44:57.305Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116418.json b/data/2026/116xxx/CVE-2026-116418.json
index ce05dae085..42b93e0dfb 100644
--- a/data/2026/116xxx/CVE-2026-116418.json
+++ b/data/2026/116xxx/CVE-2026-116418.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T09:20:16.351Z",
- "dateUpdated": "2026-11-13T09:20:16.351Z"
+ "dateUpdated": "2026-11-13T16:02:31.981Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:34:56.742807Z",
+ "id": "CVE-2026-116418",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:31.981Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116422.json b/data/2026/116xxx/CVE-2026-116422.json
index 13bd5bf8db..8d29553805 100644
--- a/data/2026/116xxx/CVE-2026-116422.json
+++ b/data/2026/116xxx/CVE-2026-116422.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T08:48:51.501Z",
- "dateUpdated": "2026-11-13T08:48:51.501Z"
+ "dateUpdated": "2026-11-13T15:52:24.895Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:52:16.242187Z",
+ "id": "CVE-2026-116422",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:52:24.895Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116423.json b/data/2026/116xxx/CVE-2026-116423.json
index 184bf7e8e7..89f0138a98 100644
--- a/data/2026/116xxx/CVE-2026-116423.json
+++ b/data/2026/116xxx/CVE-2026-116423.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T08:39:13.728Z",
- "dateUpdated": "2026-11-13T08:39:13.728Z"
+ "dateUpdated": "2026-11-13T15:55:17.658Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:55:07.617587Z",
+ "id": "CVE-2026-116423",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:17.658Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116424.json b/data/2026/116xxx/CVE-2026-116424.json
index 859549cb73..bb5c8b6143 100644
--- a/data/2026/116xxx/CVE-2026-116424.json
+++ b/data/2026/116xxx/CVE-2026-116424.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.243Z",
"datePublished": "2026-11-13T08:58:42.690Z",
- "dateUpdated": "2026-11-13T08:58:42.690Z"
+ "dateUpdated": "2026-11-13T16:02:41.451Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:07.477284Z",
+ "id": "CVE-2026-116424",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:41.451Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116426.json b/data/2026/116xxx/CVE-2026-116426.json
index f2fb9900cc..bb24137066 100644
--- a/data/2026/116xxx/CVE-2026-116426.json
+++ b/data/2026/116xxx/CVE-2026-116426.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T08:36:05.678Z",
- "dateUpdated": "2026-11-13T08:36:05.678Z"
+ "dateUpdated": "2026-11-13T16:02:49.020Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:04.716200Z",
+ "id": "CVE-2026-116426",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:49.020Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116427.json b/data/2026/116xxx/CVE-2026-116427.json
index f71195010d..730eda3b2b 100644
--- a/data/2026/116xxx/CVE-2026-116427.json
+++ b/data/2026/116xxx/CVE-2026-116427.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T08:15:39.193Z",
- "dateUpdated": "2026-11-13T08:15:39.193Z"
+ "dateUpdated": "2026-11-13T16:02:58.381Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:00.741438Z",
+ "id": "CVE-2026-116427",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:58.381Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116431.json b/data/2026/116xxx/CVE-2026-116431.json
index ae9b96177d..584841d703 100644
--- a/data/2026/116xxx/CVE-2026-116431.json
+++ b/data/2026/116xxx/CVE-2026-116431.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T09:05:36.362Z",
- "dateUpdated": "2026-11-13T09:05:36.362Z"
+ "dateUpdated": "2026-11-13T15:56:19.297Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:56:07.662146Z",
+ "id": "CVE-2026-116431",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:19.297Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116432.json b/data/2026/116xxx/CVE-2026-116432.json
index 63cfcae2d9..febdac223c 100644
--- a/data/2026/116xxx/CVE-2026-116432.json
+++ b/data/2026/116xxx/CVE-2026-116432.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.244Z",
"datePublished": "2026-11-13T08:02:42.850Z",
- "dateUpdated": "2026-11-13T08:02:42.850Z"
+ "dateUpdated": "2026-11-13T15:53:50.266Z"
},
"containers": {
"cna": {
@@ -97,6 +97,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:53:38.654948Z",
+ "id": "CVE-2026-116432",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:50.266Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/116xxx/CVE-2026-116509.json b/data/2026/116xxx/CVE-2026-116509.json
index 0b06c8b170..6e6080bbfe 100644
--- a/data/2026/116xxx/CVE-2026-116509.json
+++ b/data/2026/116xxx/CVE-2026-116509.json
@@ -8,7 +8,7 @@
"assignerShortName": "Wordfence",
"dateReserved": "2026-10-26T13:13:50.719Z",
"datePublished": "2026-11-13T09:35:15.539Z",
- "dateUpdated": "2026-11-13T09:35:15.539Z"
+ "dateUpdated": "2026-11-13T15:56:49.063Z"
},
"containers": {
"cna": {
@@ -98,6 +98,40 @@
"value": "Disclosed"
}
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:58.546107Z",
+ "id": "CVE-2026-116509",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:49.063Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/119xxx/CVE-2026-119512.json b/data/2026/119xxx/CVE-2026-119512.json
index 55b2ee2f3b..e196aaf359 100644
--- a/data/2026/119xxx/CVE-2026-119512.json
+++ b/data/2026/119xxx/CVE-2026-119512.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T15:08:41.154Z",
- "dateUpdated": "2026-11-13T15:08:41.154Z"
+ "dateUpdated": "2026-11-13T16:09:21.920Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:58:32.986323Z",
+ "id": "CVE-2026-119512",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:09:21.920Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/119xxx/CVE-2026-119517.json b/data/2026/119xxx/CVE-2026-119517.json
index 21b746420e..ae7c286d51 100644
--- a/data/2026/119xxx/CVE-2026-119517.json
+++ b/data/2026/119xxx/CVE-2026-119517.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T15:08:43.236Z",
- "dateUpdated": "2026-11-13T15:08:43.236Z"
+ "dateUpdated": "2026-11-13T16:07:54.418Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:55:22.454803Z",
+ "id": "CVE-2026-119517",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:07:54.418Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/119xxx/CVE-2026-119518.json b/data/2026/119xxx/CVE-2026-119518.json
index 15361ef124..025e7e86e1 100644
--- a/data/2026/119xxx/CVE-2026-119518.json
+++ b/data/2026/119xxx/CVE-2026-119518.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-10-30T09:20:18.657Z",
"datePublished": "2026-11-13T13:03:21.131Z",
- "dateUpdated": "2026-11-13T13:04:21.225Z"
+ "dateUpdated": "2026-11-13T15:52:28.736Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:59.552519Z",
+ "id": "CVE-2026-119518",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:52:28.736Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/120xxx/CVE-2026-120835.json b/data/2026/120xxx/CVE-2026-120835.json
index f7a885df94..68fa165e7d 100644
--- a/data/2026/120xxx/CVE-2026-120835.json
+++ b/data/2026/120xxx/CVE-2026-120835.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T00:24:21.836Z",
"datePublished": "2026-11-13T15:08:40.812Z",
- "dateUpdated": "2026-11-13T15:08:40.812Z"
+ "dateUpdated": "2026-11-13T16:09:36.392Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:58:46.355166Z",
+ "id": "CVE-2026-120835",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:09:36.392Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/121xxx/CVE-2026-121721.json b/data/2026/121xxx/CVE-2026-121721.json
index 49bffce3a2..d1ec9a084a 100644
--- a/data/2026/121xxx/CVE-2026-121721.json
+++ b/data/2026/121xxx/CVE-2026-121721.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T21:24:31.789Z",
"datePublished": "2026-11-13T13:00:24.994Z",
- "dateUpdated": "2026-11-13T13:01:26.322Z"
+ "dateUpdated": "2026-11-13T15:52:35.829Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:57.337561Z",
+ "id": "CVE-2026-121721",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:52:35.829Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/121xxx/CVE-2026-121776.json b/data/2026/121xxx/CVE-2026-121776.json
index 627a8ee214..6c5770494a 100644
--- a/data/2026/121xxx/CVE-2026-121776.json
+++ b/data/2026/121xxx/CVE-2026-121776.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-04T00:24:30.154Z",
"datePublished": "2026-11-13T15:08:41.752Z",
- "dateUpdated": "2026-11-13T15:08:41.752Z"
+ "dateUpdated": "2026-11-13T16:09:07.425Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:58:25.662966Z",
+ "id": "CVE-2026-121776",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:09:07.425Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/121xxx/CVE-2026-121808.json b/data/2026/121xxx/CVE-2026-121808.json
new file mode 100644
index 0000000000..ad4fcca690
--- /dev/null
+++ b/data/2026/121xxx/CVE-2026-121808.json
@@ -0,0 +1,459 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-121808",
+ "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
+ "state": "PUBLISHED",
+ "assignerShortName": "EEF",
+ "dateReserved": "2026-11-09T22:35:50.462Z",
+ "datePublished": "2026-11-13T15:48:49.871Z",
+ "dateUpdated": "2026-11-13T15:48:49.871Z"
+ },
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "collectionURL": "https://repo.hex.pm",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Codec.Erlpack'"
+ ],
+ "packageName": "grpc",
+ "packageURL": "pkg:hex/grpc",
+ "product": "grpc",
+ "programFiles": [
+ "lib/grpc/codec/erlpack.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "1.0.0",
+ "status": "affected",
+ "version": "0.4.0",
+ "versionType": "semver"
+ }
+ ]
+ },
+ {
+ "collectionURL": "https://github.com",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Codec.Erlpack'"
+ ],
+ "packageName": "elixir-grpc/grpc",
+ "packageURL": "pkg:github/elixir-grpc/grpc",
+ "product": "grpc",
+ "programFiles": [
+ "lib/grpc/codec/erlpack.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
+ "status": "affected",
+ "version": "25bcc569fe2cc4478531a6c546c923205fc751c9",
+ "versionType": "git"
+ }
+ ]
+ },
+ {
+ "collectionURL": "https://repo.hex.pm",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Codec.Erlpack'"
+ ],
+ "packageName": "grpc_core",
+ "packageURL": "pkg:hex/grpc_core",
+ "product": "grpc_core",
+ "programFiles": [
+ "lib/grpc/codec/erlpack.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "1.1.0",
+ "status": "affected",
+ "version": "1.0.0",
+ "versionType": "semver"
+ }
+ ]
+ },
+ {
+ "collectionURL": "https://github.com",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Codec.Erlpack'"
+ ],
+ "packageName": "elixir-grpc/grpc",
+ "packageURL": "pkg:github/elixir-grpc/grpc",
+ "product": "grpc_core",
+ "programFiles": [
+ "grpc_core/lib/grpc/codec/erlpack.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Codec.Erlpack':decode/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "d6bc56ac75dfb6c02db2099909210a37c9be8db6",
+ "status": "affected",
+ "version": "0332faae5f5e132314794dbfdae5edecbccea292",
+ "versionType": "git"
+ }
+ ]
+ }
+ ],
+ "configurations": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server."
+ }
+ ],
+ "value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server."
+ }
+ ],
+ "cpeApplicability": [
+ {
+ "nodes": [
+ {
+ "cpeMatch": [
+ {
+ "criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
+ "versionEndExcluding": "1.0.0",
+ "versionStartIncluding": "0.4.0",
+ "vulnerable": true
+ },
+ {
+ "criteria": "cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*",
+ "versionEndExcluding": "1.1.0",
+ "versionStartIncluding": "1.0.0",
+ "vulnerable": true
+ }
+ ],
+ "negate": false,
+ "operator": "OR"
+ }
+ ],
+ "operator": "AND"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Jace"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "zx"
+ },
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "zx"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Jiacheng Zhong"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Zhun Wang"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Junmin Zhu"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Hongwei Li"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Han Dai"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Suyue Guo"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Songyang Peng"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Ziyue Pan"
+ },
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Hongwei Li"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Paulo Valente"
+ },
+ {
+ "lang": "en",
+ "type": "coordinator",
+ "value": "Jonatan Männchen / EEF"
+ },
+ {
+ "lang": "en",
+ "type": "coordinator",
+ "value": "Peter Ullrich"
+ }
+ ],
+ "dateAssigned": "2026-11-12T20:11:46.000Z",
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.
\nGRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.
\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\n`GRPC.Codec.Erlpack.decode/2` (`grpc_core/lib/grpc/codec/erlpack.ex`, and `lib/grpc/codec/erlpack.ex` before the package split) passes the message body to `:erlang.binary_to_term/2`. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's `max_body_size` limit counts the compressed bytes of the request. A request with `Content-Type: application/grpc+erlpack` can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
+ }
+ ],
+ "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\nGRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
+ }
+ ],
+ "impacts": [
+ {
+ "capecId": "CAPEC-130",
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
+ }
+ ],
+ "value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV4_0": {
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "attackComplexity": "LOW",
+ "attackRequirements": "PRESENT",
+ "attackVector": "NETWORK",
+ "baseScore": 8.2,
+ "baseSeverity": "HIGH",
+ "privilegesRequired": "NONE",
+ "providerUrgency": "NOT_DEFINED",
+ "subAvailabilityImpact": "NONE",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "valueDensity": "NOT_DEFINED",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+ "version": "4.0",
+ "vulnAvailabilityImpact": "HIGH",
+ "vulnConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "vulnerabilityResponseEffort": "NOT_DEFINED"
+ },
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-409",
+ "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
+ "shortName": "EEF",
+ "dateUpdated": "2026-11-13T15:48:49.871Z"
+ },
+ "references": [
+ {
+ "name": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
+ "tags": [
+ "vendor-advisory",
+ "related"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xxp9-7hp4-rqwp"
+ },
+ {
+ "name": "EEF CNA record for CVE-2026-121808",
+ "tags": [
+ "related"
+ ],
+ "url": "https://cna.erlef.org/cves/CVE-2026-121808.html"
+ },
+ {
+ "name": "OSV record EEF-CVE-2026-121808",
+ "tags": [
+ "related"
+ ],
+ "url": "https://osv.dev/vulnerability/EEF-CVE-2026-121808"
+ },
+ {
+ "name": "Introducing commit 25bcc56 in elixir-grpc/grpc",
+ "tags": [
+ "related"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"
+ },
+ {
+ "name": "Fix commit 0332faa in elixir-grpc/grpc",
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
+ },
+ {
+ "name": "Fix commit d6bc56a in elixir-grpc/grpc",
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
+ "workarounds": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Remove GRPC.Codec.Erlpack from the server's codecs list if the codec is not needed.
\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the GRPC.Codec behaviour, returns \"erlpack\" from name/0, raises in decode/2 when the body starts with the bytes 131, 80 (the compressed term tag), and delegates all other calls to GRPC.Codec.Erlpack.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "Remove `GRPC.Codec.Erlpack` from the server's `codecs` list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the `GRPC.Codec` behaviour, returns `\"erlpack\"` from `name/0`, raises in `decode/2` when the body starts with the bytes `131, 80` (the compressed term tag), and delegates all other calls to `GRPC.Codec.Erlpack`."
+ }
+ ],
+ "value": "Remove GRPC.Codec.Erlpack from the server's codecs list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the GRPC.Codec behaviour, returns \"erlpack\" from name/0, raises in decode/2 when the body starts with the bytes 131, 80 (the compressed term tag), and delegates all other calls to GRPC.Codec.Erlpack."
+ }
+ ],
+ "x_proofOfConcept": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n- Start a gRPC server that registers
GRPC.Codec.Erlpack in its codecs list. \n- Build the payload with
:erlang.term_to_binary(:binary.copy(<<0>>, 268_435_456), [:compressed]). The result is 260,932 bytes. \n- Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with
Content-Type: application/grpc+erlpack. \n- Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback.
\n
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "1. Start a gRPC server that registers `GRPC.Codec.Erlpack` in its `codecs` list.\n2. Build the payload with `:erlang.term_to_binary(:binary.copy(<<0>>, 268_435_456), [:compressed])`. The result is 260,932 bytes.\n3. Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with `Content-Type: application/grpc+erlpack`.\n4. Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
+ }
+ ],
+ "value": "* Start a gRPC server that registers GRPC.Codec.Erlpack in its codecs list.\n* Build the payload with :erlang.term_to_binary(:binary.copy(<<0>>, 268_435_456), [:compressed]). The result is 260,932 bytes.\n* Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with Content-Type: application/grpc+erlpack.\n* Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
+ }
+ ],
+ "x_technicalAnalysis": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "1. Codec selection
\nThe server selects the codec from the request Content-Type. application/grpc+erlpack selects GRPC.Codec.Erlpack when the server registers it. No authentication step comes before this.
\n2. Size limit on compressed bytes only
\nThe server limits the request body with max_body_size, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.
\n3. Expansion inside binary_to_term/2
\nGRPC.Codec.Erlpack.decode/2 calls :erlang.binary_to_term(binary, [:safe]). The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). binary_to_term/2 inflates it in full, and the :safe option does not limit the size. ensure_safe_term!/1 runs after the call returns and accepts a large binary.
\n4. Result
\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "**1. Codec selection**\n\nThe server selects the codec from the request `Content-Type`. `application/grpc+erlpack` selects `GRPC.Codec.Erlpack` when the server registers it. No authentication step comes before this.\n\n**2. Size limit on compressed bytes only**\n\nThe server limits the request body with `max_body_size`, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n**3. Expansion inside `binary_to_term/2`**\n\n`GRPC.Codec.Erlpack.decode/2` calls `:erlang.binary_to_term(binary, [:safe])`. The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). `binary_to_term/2` inflates it in full, and the `:safe` option does not limit the size. `ensure_safe_term!/1` runs after the call returns and accepts a large binary.\n\n**4. Result**\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
+ }
+ ],
+ "value": "1. Codec selection\n\nThe server selects the codec from the request Content-Type. application/grpc+erlpack selects GRPC.Codec.Erlpack when the server registers it. No authentication step comes before this.\n\n2. Size limit on compressed bytes only\n\nThe server limits the request body with max_body_size, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n3. Expansion inside binary_to_term/2\n\nGRPC.Codec.Erlpack.decode/2 calls :erlang.binary_to_term(binary, [:safe]). The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). binary_to_term/2 inflates it in full, and the :safe option does not limit the size. ensure_safe_term!/1 runs after the call returns and accepts a large binary.\n\n4. Result\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
+ }
+ ]
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/123xxx/CVE-2026-123635.json b/data/2026/123xxx/CVE-2026-123635.json
new file mode 100644
index 0000000000..140822b75c
--- /dev/null
+++ b/data/2026/123xxx/CVE-2026-123635.json
@@ -0,0 +1,329 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-123635",
+ "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
+ "state": "PUBLISHED",
+ "assignerShortName": "EEF",
+ "dateReserved": "2026-11-09T22:27:54.995Z",
+ "datePublished": "2026-11-13T15:40:16.288Z",
+ "dateUpdated": "2026-11-13T15:40:16.288Z"
+ },
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "collectionURL": "https://repo.hex.pm",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "grpc_stream_h"
+ ],
+ "packageName": "grpc_server",
+ "packageURL": "pkg:hex/grpc_server",
+ "product": "grpc_server",
+ "programFiles": [
+ "src/grpc_stream_h.erl"
+ ],
+ "programRoutines": [
+ {
+ "name": "grpc_stream_h:init/3"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "1.1.0",
+ "status": "affected",
+ "version": "1.0.0",
+ "versionType": "semver"
+ }
+ ]
+ },
+ {
+ "collectionURL": "https://github.com",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "grpc_stream_h"
+ ],
+ "packageName": "elixir-grpc/grpc",
+ "packageURL": "pkg:github/elixir-grpc/grpc",
+ "product": "grpc_server",
+ "programFiles": [
+ "grpc_server/src/grpc_stream_h.erl"
+ ],
+ "programRoutines": [
+ {
+ "name": "grpc_stream_h:init/3"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "61a71948e6e7b95efb27d48e7084c764503cc802",
+ "status": "affected",
+ "version": "0332faae5f5e132314794dbfdae5edecbccea292",
+ "versionType": "git"
+ }
+ ]
+ }
+ ],
+ "configurations": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
+ }
+ ],
+ "value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
+ }
+ ],
+ "cpeApplicability": [
+ {
+ "nodes": [
+ {
+ "cpeMatch": [
+ {
+ "criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
+ "versionEndExcluding": "1.1.0",
+ "versionStartIncluding": "1.0.0",
+ "vulnerable": true
+ }
+ ],
+ "negate": false,
+ "operator": "OR"
+ }
+ ],
+ "operator": "AND"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Aaron Lovi"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Aaron Lovi"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Paulo Valente"
+ },
+ {
+ "lang": "en",
+ "type": "coordinator",
+ "value": "Jonatan Männchen / EEF"
+ }
+ ],
+ "dateAssigned": "2026-11-12T20:33:14.000Z",
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.
\nThe stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.
\nThis issue affects grpc_server: from 1.0.0 before 1.1.0.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler `grpc_stream_h` (`grpc_server/src/grpc_stream_h.erl`) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds `max_body_size` or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
+ }
+ ],
+ "value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
+ }
+ ],
+ "impacts": [
+ {
+ "capecId": "CAPEC-131",
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
+ }
+ ],
+ "value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV4_0": {
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "attackComplexity": "LOW",
+ "attackRequirements": "PRESENT",
+ "attackVector": "NETWORK",
+ "baseScore": 6.3,
+ "baseSeverity": "MEDIUM",
+ "privilegesRequired": "NONE",
+ "providerUrgency": "NOT_DEFINED",
+ "subAvailabilityImpact": "NONE",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "valueDensity": "NOT_DEFINED",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
+ "version": "4.0",
+ "vulnAvailabilityImpact": "LOW",
+ "vulnConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "vulnerabilityResponseEffort": "NOT_DEFINED"
+ },
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-772",
+ "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
+ "shortName": "EEF",
+ "dateUpdated": "2026-11-13T15:40:16.288Z"
+ },
+ "references": [
+ {
+ "name": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
+ "tags": [
+ "vendor-advisory",
+ "related"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr"
+ },
+ {
+ "name": "EEF CNA record for CVE-2026-123635",
+ "tags": [
+ "related"
+ ],
+ "url": "https://cna.erlef.org/cves/CVE-2026-123635.html"
+ },
+ {
+ "name": "OSV record EEF-CVE-2026-123635",
+ "tags": [
+ "related"
+ ],
+ "url": "https://osv.dev/vulnerability/EEF-CVE-2026-123635"
+ },
+ {
+ "name": "Introducing commit 0332faa in elixir-grpc/grpc",
+ "tags": [
+ "related"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
+ },
+ {
+ "name": "Fix commit 61a7194 in elixir-grpc/grpc",
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
+ "workarounds": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Put a Cowboy stream handler in front of grpc_stream_h with the adapter option stream_handlers: [MyHandler, :grpc_stream_h]. In init/3, the handler calls :cowboy_stream.init/3 and adds a {:flow, size} command when the request has a body, where size is Cowboy's max_frame_size_received (16384 by default). It passes all other callbacks to :cowboy_stream.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "Put a Cowboy stream handler in front of `grpc_stream_h` with the adapter option `stream_handlers: [MyHandler, :grpc_stream_h]`. In `init/3`, the handler calls `:cowboy_stream.init/3` and adds a `{:flow, size}` command when the request has a body, where `size` is Cowboy's `max_frame_size_received` (16384 by default). It passes all other callbacks to `:cowboy_stream`."
+ }
+ ],
+ "value": "Put a Cowboy stream handler in front of grpc_stream_h with the adapter option stream_handlers: [MyHandler, :grpc_stream_h]. In init/3, the handler calls :cowboy_stream.init/3 and adds a {:flow, size} command when the request has a body, where size is Cowboy's max_frame_size_received (16384 by default). It passes all other callbacks to :cowboy_stream."
+ }
+ ],
+ "x_proofOfConcept": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n- Start a gRPC server with a small
max_body_size, for example 1000 bytes. \n- Open one HTTP/2 connection with a client that tracks the connection window.
\n- Send a unary call with a body above the limit and wait for the
RESOURCE_EXHAUSTED reply. \n- Send more DATA frames on the refused stream, up to what the stream and connection windows allow.
\n- Repeat steps 3 and 4 on new streams until the connection window is 0.
\n- Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline.
\n
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "1. Start a gRPC server with a small `max_body_size`, for example 1000 bytes.\n2. Open one HTTP/2 connection with a client that tracks the connection window.\n3. Send a unary call with a body above the limit and wait for the `RESOURCE_EXHAUSTED` reply.\n4. Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n5. Repeat steps 3 and 4 on new streams until the connection window is 0.\n6. Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
+ }
+ ],
+ "value": "* Start a gRPC server with a small max_body_size, for example 1000 bytes.\n* Open one HTTP/2 connection with a client that tracks the connection window.\n* Send a unary call with a body above the limit and wait for the RESOURCE_EXHAUSTED reply.\n* Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n* Repeat steps 3 and 4 on new streams until the connection window is 0.\n* Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
+ }
+ ],
+ "x_technicalAnalysis": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "1. Flow is requested only for data that arrived
\nCowboy increases the HTTP/2 connection window only when a stream handler returns a {flow, N} command. grpc_stream_h returns that command only for request data it has received.
\n2. A refused call leaves data uncredited
\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level WINDOW_UPDATE is sent.
\n3. The window empties
\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.
\n4. Result
\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "**1. Flow is requested only for data that arrived**\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a `{flow, N}` command. `grpc_stream_h` returns that command only for request data it has received.\n\n**2. A refused call leaves data uncredited**\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level `WINDOW_UPDATE` is sent.\n\n**3. The window empties**\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n**4. Result**\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
+ }
+ ],
+ "value": "1. Flow is requested only for data that arrived\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a {flow, N} command. grpc_stream_h returns that command only for request data it has received.\n\n2. A refused call leaves data uncredited\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level WINDOW_UPDATE is sent.\n\n3. The window empties\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n4. Result\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
+ }
+ ]
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124260.json b/data/2026/124xxx/CVE-2026-124260.json
index a735c796d9..8e18c27540 100644
--- a/data/2026/124xxx/CVE-2026-124260.json
+++ b/data/2026/124xxx/CVE-2026-124260.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:41.519Z",
- "dateUpdated": "2026-11-13T15:08:41.519Z"
+ "dateUpdated": "2026-11-13T15:58:32.121Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:10.752107Z",
+ "id": "CVE-2026-124260",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:32.121Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124265.json b/data/2026/124xxx/CVE-2026-124265.json
index fc96fbf700..f95dfb118d 100644
--- a/data/2026/124xxx/CVE-2026-124265.json
+++ b/data/2026/124xxx/CVE-2026-124265.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:42.588Z",
- "dateUpdated": "2026-11-13T15:08:42.588Z"
+ "dateUpdated": "2026-11-13T16:08:23.954Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:35.862751Z",
+ "id": "CVE-2026-124265",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:08:23.954Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124267.json b/data/2026/124xxx/CVE-2026-124267.json
index 2bca6e7bee..c32892553d 100644
--- a/data/2026/124xxx/CVE-2026-124267.json
+++ b/data/2026/124xxx/CVE-2026-124267.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-13T15:08:42.065Z",
- "dateUpdated": "2026-11-13T15:08:42.065Z"
+ "dateUpdated": "2026-11-13T16:08:52.884Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:57.590818Z",
+ "id": "CVE-2026-124267",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:08:52.884Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124272.json b/data/2026/124xxx/CVE-2026-124272.json
index 25901fca7a..d921ebeeaa 100644
--- a/data/2026/124xxx/CVE-2026-124272.json
+++ b/data/2026/124xxx/CVE-2026-124272.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.636Z",
"datePublished": "2026-11-13T15:08:41.860Z",
- "dateUpdated": "2026-11-13T15:08:41.860Z"
+ "dateUpdated": "2026-11-13T15:58:17.174Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:07.889270Z",
+ "id": "CVE-2026-124272",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:17.174Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124278.json b/data/2026/124xxx/CVE-2026-124278.json
new file mode 100644
index 0000000000..a6bc129af5
--- /dev/null
+++ b/data/2026/124xxx/CVE-2026-124278.json
@@ -0,0 +1,421 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-124278",
+ "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
+ "state": "PUBLISHED",
+ "assignerShortName": "EEF",
+ "dateReserved": "2026-11-09T23:03:52.038Z",
+ "datePublished": "2026-11-13T15:58:08.134Z",
+ "dateUpdated": "2026-11-13T15:58:08.134Z"
+ },
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "collectionURL": "https://repo.hex.pm",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Server'",
+ "'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
+ ],
+ "packageName": "grpc_server",
+ "packageURL": "pkg:hex/grpc_server",
+ "product": "grpc_server",
+ "programFiles": [
+ "lib/grpc/server.ex",
+ "lib/grpc/server/adapters/cowboy/handler.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Server':do_handle_request/4"
+ },
+ {
+ "name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "1.1.0",
+ "status": "affected",
+ "version": "1.0.0",
+ "versionType": "semver"
+ }
+ ]
+ },
+ {
+ "collectionURL": "https://github.com",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Server'",
+ "'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
+ ],
+ "packageName": "elixir-grpc/grpc",
+ "packageURL": "pkg:github/elixir-grpc/grpc",
+ "product": "grpc_server",
+ "programFiles": [
+ "grpc_server/lib/grpc/server.ex",
+ "grpc_server/lib/grpc/server/adapters/cowboy/handler.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Server':do_handle_request/4"
+ },
+ {
+ "name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "953ab980d8a127e895d3ab9505fc4b9337bb32f7",
+ "status": "affected",
+ "version": "0332faae5f5e132314794dbfdae5edecbccea292",
+ "versionType": "git"
+ }
+ ]
+ },
+ {
+ "collectionURL": "https://repo.hex.pm",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Server'",
+ "'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
+ ],
+ "packageName": "grpc",
+ "packageURL": "pkg:hex/grpc",
+ "product": "grpc",
+ "programFiles": [
+ "lib/grpc/server.ex",
+ "lib/grpc/server/adapters/cowboy/handler.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Server':do_handle_request/4"
+ },
+ {
+ "name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "1.0.0",
+ "status": "affected",
+ "version": "0.8.0",
+ "versionType": "semver"
+ }
+ ]
+ },
+ {
+ "collectionURL": "https://github.com",
+ "cpes": [
+ "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
+ ],
+ "defaultStatus": "unaffected",
+ "modules": [
+ "'Elixir.GRPC.Server'",
+ "'Elixir.GRPC.Server.Adapters.Cowboy.Handler'"
+ ],
+ "packageName": "elixir-grpc/grpc",
+ "packageURL": "pkg:github/elixir-grpc/grpc",
+ "product": "grpc",
+ "programFiles": [
+ "lib/grpc/server.ex",
+ "lib/grpc/server/adapters/cowboy/handler.ex"
+ ],
+ "programRoutines": [
+ {
+ "name": "'Elixir.GRPC.Server':do_handle_request/4"
+ },
+ {
+ "name": "'Elixir.GRPC.Server.Adapters.Cowboy.Handler':init/2"
+ }
+ ],
+ "repo": "https://github.com/elixir-grpc/grpc",
+ "vendor": "elixir-grpc",
+ "versions": [
+ {
+ "lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
+ "status": "affected",
+ "version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
+ "versionType": "git"
+ }
+ ]
+ }
+ ],
+ "configurations": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "HTTP-to-gRPC transcoding must be enabled with http_transcode: true. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "HTTP-to-gRPC transcoding must be enabled with `http_transcode: true`. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
+ }
+ ],
+ "value": "HTTP-to-gRPC transcoding must be enabled with http_transcode: true. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
+ }
+ ],
+ "cpeApplicability": [
+ {
+ "nodes": [
+ {
+ "cpeMatch": [
+ {
+ "criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
+ "versionEndExcluding": "1.1.0",
+ "versionStartIncluding": "1.0.0",
+ "vulnerable": true
+ },
+ {
+ "criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
+ "versionEndExcluding": "1.0.0",
+ "versionStartIncluding": "0.8.0",
+ "vulnerable": true
+ }
+ ],
+ "negate": false,
+ "operator": "OR"
+ }
+ ],
+ "operator": "AND"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Eurico Nicacio"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Eurico Nicacio"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Paulo Valente"
+ },
+ {
+ "lang": "en",
+ "type": "coordinator",
+ "value": "Peter Ullrich"
+ },
+ {
+ "lang": "en",
+ "type": "coordinator",
+ "value": "Jonatan Männchen / EEF"
+ }
+ ],
+ "dateAssigned": "2026-11-13T11:18:41.000Z",
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.
\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.
\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of `GRPC.Server.do_handle_request/4` (`grpc_server/lib/grpc/server.ex`, and `lib/grpc/server.ex` before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request `Content-Type`, not from the route. A request to a transcoded URL with `application/grpc` or `application/grpc-web` is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
+ }
+ ],
+ "value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
+ }
+ ],
+ "impacts": [
+ {
+ "capecId": "CAPEC-460",
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data."
+ }
+ ],
+ "value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data."
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV4_0": {
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "attackComplexity": "LOW",
+ "attackRequirements": "PRESENT",
+ "attackVector": "NETWORK",
+ "baseScore": 7.6,
+ "baseSeverity": "HIGH",
+ "privilegesRequired": "LOW",
+ "providerUrgency": "NOT_DEFINED",
+ "subAvailabilityImpact": "NONE",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "valueDensity": "NOT_DEFINED",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
+ "version": "4.0",
+ "vulnAvailabilityImpact": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnerabilityResponseEffort": "NOT_DEFINED"
+ },
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-436",
+ "description": "CWE-436 Interpretation Conflict",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-639",
+ "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
+ "shortName": "EEF",
+ "dateUpdated": "2026-11-13T15:58:08.134Z"
+ },
+ "references": [
+ {
+ "name": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
+ "tags": [
+ "vendor-advisory",
+ "related"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m"
+ },
+ {
+ "name": "EEF CNA record for CVE-2026-124278",
+ "tags": [
+ "related"
+ ],
+ "url": "https://cna.erlef.org/cves/CVE-2026-124278.html"
+ },
+ {
+ "name": "OSV record EEF-CVE-2026-124278",
+ "tags": [
+ "related"
+ ],
+ "url": "https://osv.dev/vulnerability/EEF-CVE-2026-124278"
+ },
+ {
+ "name": "Introducing commit 0332faa in elixir-grpc/grpc",
+ "tags": [
+ "related"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
+ },
+ {
+ "name": "Fix commit 953ab98 in elixir-grpc/grpc",
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7"
+ },
+ {
+ "name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
+ "tags": [
+ "related"
+ ],
+ "url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
+ "x_proofOfConcept": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n- Start a server with
http_transcode: true and a transcoded route that binds a field from the path, for example GET /v1/messages/{name}. \n- Build a gRPC frame whose message sets
name to victim. \n- Send it over HTTP/1.1 as
GET /v1/messages/alice with Content-Type: application/grpc. \n- Observe that the handler receives
name set to victim, not alice. \n
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "1. Start a server with `http_transcode: true` and a transcoded route that binds a field from the path, for example `GET /v1/messages/{name}`.\n2. Build a gRPC frame whose message sets `name` to `victim`.\n3. Send it over HTTP/1.1 as `GET /v1/messages/alice` with `Content-Type: application/grpc`.\n4. Observe that the handler receives `name` set to `victim`, not `alice`."
+ }
+ ],
+ "value": "* Start a server with http_transcode: true and a transcoded route that binds a field from the path, for example GET /v1/messages/{name}.\n* Build a gRPC frame whose message sets name to victim.\n* Send it over HTTP/1.1 as GET /v1/messages/alice with Content-Type: application/grpc.\n* Observe that the handler receives name set to victim, not alice."
+ }
+ ],
+ "x_technicalAnalysis": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "1. The header selects the clause
\nThe Cowboy handler derives the access mode from the request Content-Type. application/json selects :http_transcoding, application/grpc selects :grpc and application/grpc-web+proto selects :grpcweb. The router still matches the transcoded URL template and extracts its path bindings.
\n2. Bindings are applied in one clause only
\nGRPC.Server.do_handle_request/4 reads the bindings with adapter.get_bindings/1 and merges them through GRPC.Server.Transcode.map_request/5 only in the :http_transcoding clause. The unary and request-streaming clauses decode the body alone with the selected codec. GRPC.Codec.Proto is in the default codecs of every server, so application/grpc is always accepted.
\n3. The HTTP/1.1 guard never matches
\nresolve_access_mode/3 has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \"HTTP/1.1\", while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.
\n4. Result
\nA request to /v1/messages/alice with Content-Type: application/grpc and a message that sets name to victim reaches the handler with name set to victim. With an empty message the field is empty: the path binding is never consulted.
"
+ },
+ {
+ "base64": false,
+ "type": "text/markdown",
+ "value": "**1. The header selects the clause**\n\nThe Cowboy handler derives the access mode from the request `Content-Type`. `application/json` selects `:http_transcoding`, `application/grpc` selects `:grpc` and `application/grpc-web+proto` selects `:grpcweb`. The router still matches the transcoded URL template and extracts its path bindings.\n\n**2. Bindings are applied in one clause only**\n\n`GRPC.Server.do_handle_request/4` reads the bindings with `adapter.get_bindings/1` and merges them through `GRPC.Server.Transcode.map_request/5` only in the `:http_transcoding` clause. The unary and request-streaming clauses decode the body alone with the selected codec. `GRPC.Codec.Proto` is in the default codecs of every server, so `application/grpc` is always accepted.\n\n**3. The HTTP/1.1 guard never matches**\n\n`resolve_access_mode/3` has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary `\"HTTP/1.1\"`, while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n**4. Result**\n\nA request to `/v1/messages/alice` with `Content-Type: application/grpc` and a message that sets `name` to `victim` reaches the handler with `name` set to `victim`. With an empty message the field is empty: the path binding is never consulted."
+ }
+ ],
+ "value": "1. The header selects the clause\n\nThe Cowboy handler derives the access mode from the request Content-Type. application/json selects :http_transcoding, application/grpc selects :grpc and application/grpc-web+proto selects :grpcweb. The router still matches the transcoded URL template and extracts its path bindings.\n\n2. Bindings are applied in one clause only\n\nGRPC.Server.do_handle_request/4 reads the bindings with adapter.get_bindings/1 and merges them through GRPC.Server.Transcode.map_request/5 only in the :http_transcoding clause. The unary and request-streaming clauses decode the body alone with the selected codec. GRPC.Codec.Proto is in the default codecs of every server, so application/grpc is always accepted.\n\n3. The HTTP/1.1 guard never matches\n\nresolve_access_mode/3 has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \"HTTP/1.1\", while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n4. Result\n\nA request to /v1/messages/alice with Content-Type: application/grpc and a message that sets name to victim reaches the handler with name set to victim. With an empty message the field is empty: the path binding is never consulted."
+ }
+ ]
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124409.json b/data/2026/124xxx/CVE-2026-124409.json
index bb60839260..37c598600f 100644
--- a/data/2026/124xxx/CVE-2026-124409.json
+++ b/data/2026/124xxx/CVE-2026-124409.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T14:39:29.907Z",
- "dateUpdated": "2026-11-13T14:40:31.659Z"
+ "dateUpdated": "2026-11-13T16:14:06.743Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:02:33.694825Z",
+ "id": "CVE-2026-124409",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:14:06.743Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124410.json b/data/2026/124xxx/CVE-2026-124410.json
index b7904f7d97..8f35ea1df9 100644
--- a/data/2026/124xxx/CVE-2026-124410.json
+++ b/data/2026/124xxx/CVE-2026-124410.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:42.902Z",
- "dateUpdated": "2026-11-13T15:08:42.902Z"
+ "dateUpdated": "2026-11-13T15:57:27.854Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:56:58.734777Z",
+ "id": "CVE-2026-124410",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:57:27.854Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124414.json b/data/2026/124xxx/CVE-2026-124414.json
index 8632a9f3b1..4dbf4eb0e9 100644
--- a/data/2026/124xxx/CVE-2026-124414.json
+++ b/data/2026/124xxx/CVE-2026-124414.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:42.440Z",
- "dateUpdated": "2026-11-13T15:08:42.440Z"
+ "dateUpdated": "2026-11-13T16:08:38.407Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:44.222208Z",
+ "id": "CVE-2026-124414",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:08:38.407Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124415.json b/data/2026/124xxx/CVE-2026-124415.json
index f28856c63a..0363a87368 100644
--- a/data/2026/124xxx/CVE-2026-124415.json
+++ b/data/2026/124xxx/CVE-2026-124415.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T15:08:43.121Z",
- "dateUpdated": "2026-11-13T15:08:43.121Z"
+ "dateUpdated": "2026-11-13T16:08:09.467Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:55:15.857880Z",
+ "id": "CVE-2026-124415",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:08:09.467Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124418.json b/data/2026/124xxx/CVE-2026-124418.json
index 336128f460..b6dfd24e93 100644
--- a/data/2026/124xxx/CVE-2026-124418.json
+++ b/data/2026/124xxx/CVE-2026-124418.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.331Z",
"datePublished": "2026-11-13T15:08:42.240Z",
- "dateUpdated": "2026-11-13T15:08:42.240Z"
+ "dateUpdated": "2026-11-13T15:58:02.199Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:04.968268Z",
+ "id": "CVE-2026-124418",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:02.199Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124420.json b/data/2026/124xxx/CVE-2026-124420.json
index 53f5cf568a..f53de6a005 100644
--- a/data/2026/124xxx/CVE-2026-124420.json
+++ b/data/2026/124xxx/CVE-2026-124420.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.331Z",
"datePublished": "2026-11-13T15:08:41.418Z",
- "dateUpdated": "2026-11-13T15:08:41.418Z"
+ "dateUpdated": "2026-11-13T15:58:49.170Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:13.388977Z",
+ "id": "CVE-2026-124420",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:49.170Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124965.json b/data/2026/124xxx/CVE-2026-124965.json
index c71ea6e7ed..fd4ae6a2dd 100644
--- a/data/2026/124xxx/CVE-2026-124965.json
+++ b/data/2026/124xxx/CVE-2026-124965.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T15:06:57.634Z",
"datePublished": "2026-11-13T15:08:42.786Z",
- "dateUpdated": "2026-11-13T15:08:42.786Z"
+ "dateUpdated": "2026-11-13T15:57:45.624Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:01.597861Z",
+ "id": "CVE-2026-124965",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:57:45.624Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/124xxx/CVE-2026-124970.json b/data/2026/124xxx/CVE-2026-124970.json
index ac2823de07..630c6c31f8 100644
--- a/data/2026/124xxx/CVE-2026-124970.json
+++ b/data/2026/124xxx/CVE-2026-124970.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T15:12:36.503Z",
"datePublished": "2026-11-13T15:08:40.764Z",
- "dateUpdated": "2026-11-13T15:08:40.764Z"
+ "dateUpdated": "2026-11-13T16:09:50.894Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:59:12.219833Z",
+ "id": "CVE-2026-124970",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:09:50.894Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125122.json b/data/2026/125xxx/CVE-2026-125122.json
index b02dac429a..8b51e2e54f 100644
--- a/data/2026/125xxx/CVE-2026-125122.json
+++ b/data/2026/125xxx/CVE-2026-125122.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T17:45:35.936Z",
"datePublished": "2026-11-10T16:50:46.826Z",
- "dateUpdated": "2026-11-10T16:50:46.826Z"
+ "dateUpdated": "2026-11-13T15:25:23.463Z"
},
"containers": {
"cna": {
@@ -113,6 +113,40 @@
"advisory": "GHSA-hr4h-4c45-v4q4",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:25:03.488776Z",
+ "id": "CVE-2026-125122",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:25:23.463Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125320.json b/data/2026/125xxx/CVE-2026-125320.json
index e87e3f63e7..982523475f 100644
--- a/data/2026/125xxx/CVE-2026-125320.json
+++ b/data/2026/125xxx/CVE-2026-125320.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.597Z",
"datePublished": "2026-11-10T17:23:43.734Z",
- "dateUpdated": "2026-11-10T17:23:43.734Z"
+ "dateUpdated": "2026-11-13T15:31:58.504Z"
},
"containers": {
"cna": {
@@ -107,6 +107,40 @@
"advisory": "GHSA-6hg5-9f3w-c886",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:31:40.892443Z",
+ "id": "CVE-2026-125320",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:31:58.504Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125325.json b/data/2026/125xxx/CVE-2026-125325.json
index 35e2370542..e07043fa68 100644
--- a/data/2026/125xxx/CVE-2026-125325.json
+++ b/data/2026/125xxx/CVE-2026-125325.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.597Z",
"datePublished": "2026-11-10T17:58:40.428Z",
- "dateUpdated": "2026-11-10T17:58:40.428Z"
+ "dateUpdated": "2026-11-13T15:33:27.769Z"
},
"containers": {
"cna": {
@@ -110,6 +110,40 @@
"advisory": "GHSA-w437-9mwm-j6vq",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:33:16.391558Z",
+ "id": "CVE-2026-125325",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:33:27.769Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125328.json b/data/2026/125xxx/CVE-2026-125328.json
index c10207ff6c..3fde15341a 100644
--- a/data/2026/125xxx/CVE-2026-125328.json
+++ b/data/2026/125xxx/CVE-2026-125328.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.598Z",
"datePublished": "2026-11-10T18:05:20.491Z",
- "dateUpdated": "2026-11-10T18:05:20.491Z"
+ "dateUpdated": "2026-11-13T15:34:20.583Z"
},
"containers": {
"cna": {
@@ -117,6 +117,40 @@
"advisory": "GHSA-8835-xmqj-354h",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:33:59.094273Z",
+ "id": "CVE-2026-125328",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:34:20.583Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125336.json b/data/2026/125xxx/CVE-2026-125336.json
index 4638d774e6..6ca614e75c 100644
--- a/data/2026/125xxx/CVE-2026-125336.json
+++ b/data/2026/125xxx/CVE-2026-125336.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.599Z",
"datePublished": "2026-11-10T18:52:37.915Z",
- "dateUpdated": "2026-11-10T18:52:37.915Z"
+ "dateUpdated": "2026-11-13T15:41:15.447Z"
},
"containers": {
"cna": {
@@ -107,6 +107,48 @@
"advisory": "GHSA-3cc4-3294-vgjf",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "references": [
+ {
+ "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-3cc4-3294-vgjf",
+ "tags": [
+ "exploit"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:38:29.973125Z",
+ "id": "CVE-2026-125336",
+ "options": [
+ {
+ "Exploitation": "poc"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:41:15.447Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125340.json b/data/2026/125xxx/CVE-2026-125340.json
index ed27ba22e9..3ab185378b 100644
--- a/data/2026/125xxx/CVE-2026-125340.json
+++ b/data/2026/125xxx/CVE-2026-125340.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-09T21:22:55.599Z",
"datePublished": "2026-11-10T20:07:15.283Z",
- "dateUpdated": "2026-11-10T20:07:15.283Z"
+ "dateUpdated": "2026-11-13T15:44:37.421Z"
},
"containers": {
"cna": {
@@ -93,6 +93,40 @@
"advisory": "GHSA-hq84-x37p-j6q5",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:42:01.267953Z",
+ "id": "CVE-2026-125340",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:44:37.421Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125402.json b/data/2026/125xxx/CVE-2026-125402.json
index 4d3bb69fff..a60772c7d5 100644
--- a/data/2026/125xxx/CVE-2026-125402.json
+++ b/data/2026/125xxx/CVE-2026-125402.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-09T22:03:15.846Z",
"datePublished": "2026-11-09T23:28:04.231Z",
- "dateUpdated": "2026-11-09T23:28:04.231Z"
+ "dateUpdated": "2026-11-13T16:14:38.283Z"
},
"containers": {
"cna": {
@@ -160,6 +160,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:12:39.401109Z",
+ "id": "CVE-2026-125402",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:14:38.283Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125432.json b/data/2026/125xxx/CVE-2026-125432.json
index fa5aa790a4..d4c8368318 100644
--- a/data/2026/125xxx/CVE-2026-125432.json
+++ b/data/2026/125xxx/CVE-2026-125432.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.520Z",
"datePublished": "2026-11-13T15:08:43.468Z",
- "dateUpdated": "2026-11-13T15:08:43.468Z"
+ "dateUpdated": "2026-11-13T16:07:38.892Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:55:03.486970Z",
+ "id": "CVE-2026-125432",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:07:38.892Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125452.json b/data/2026/125xxx/CVE-2026-125452.json
index 4ded81dc21..7fcd81d05f 100644
--- a/data/2026/125xxx/CVE-2026-125452.json
+++ b/data/2026/125xxx/CVE-2026-125452.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.522Z",
"datePublished": "2026-11-13T15:08:38.883Z",
- "dateUpdated": "2026-11-13T15:08:38.883Z"
+ "dateUpdated": "2026-11-13T16:00:13.064Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:29.351299Z",
+ "id": "CVE-2026-125452",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:13.064Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125755.json b/data/2026/125xxx/CVE-2026-125755.json
index 58c62432ce..8a76a46e69 100644
--- a/data/2026/125xxx/CVE-2026-125755.json
+++ b/data/2026/125xxx/CVE-2026-125755.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T12:36:09.129Z",
"datePublished": "2026-11-10T15:22:50.055Z",
- "dateUpdated": "2026-11-10T15:22:50.055Z"
+ "dateUpdated": "2026-11-13T15:21:26.856Z"
},
"containers": {
"cna": {
@@ -155,6 +155,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "references": [
+ {
+ "url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8",
+ "tags": [
+ "exploit"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:20:34.361781Z",
+ "id": "CVE-2026-125755",
+ "options": [
+ {
+ "Exploitation": "poc"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:21:26.856Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125759.json b/data/2026/125xxx/CVE-2026-125759.json
index dbdacaebbf..a2b01b99f9 100644
--- a/data/2026/125xxx/CVE-2026-125759.json
+++ b/data/2026/125xxx/CVE-2026-125759.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T12:36:10.513Z",
"datePublished": "2026-11-10T15:22:52.910Z",
- "dateUpdated": "2026-11-10T15:22:52.910Z"
+ "dateUpdated": "2026-11-13T15:22:46.074Z"
},
"containers": {
"cna": {
@@ -145,6 +145,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "references": [
+ {
+ "url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-8m28-9wcj-v8ww",
+ "tags": [
+ "exploit"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:22:17.927198Z",
+ "id": "CVE-2026-125759",
+ "options": [
+ {
+ "Exploitation": "poc"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:22:46.074Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125783.json b/data/2026/125xxx/CVE-2026-125783.json
index 15d67d7241..0ab76f4995 100644
--- a/data/2026/125xxx/CVE-2026-125783.json
+++ b/data/2026/125xxx/CVE-2026-125783.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.984Z",
"datePublished": "2026-11-13T15:08:41.100Z",
- "dateUpdated": "2026-11-13T15:08:41.100Z"
+ "dateUpdated": "2026-11-13T15:59:07.746Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:16.594692Z",
+ "id": "CVE-2026-125783",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:07.746Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125785.json b/data/2026/125xxx/CVE-2026-125785.json
index 7f1d381707..a8d5528306 100644
--- a/data/2026/125xxx/CVE-2026-125785.json
+++ b/data/2026/125xxx/CVE-2026-125785.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.984Z",
"datePublished": "2026-11-12T00:12:02.005Z",
- "dateUpdated": "2026-11-12T00:13:02.392Z"
+ "dateUpdated": "2026-11-13T16:02:55.705Z"
},
"containers": {
"cna": {
@@ -131,6 +131,40 @@
]
}
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:58:07.780687Z",
+ "id": "CVE-2026-125785",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:55.705Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125792.json b/data/2026/125xxx/CVE-2026-125792.json
index c5a055f8b2..f0b0083c11 100644
--- a/data/2026/125xxx/CVE-2026-125792.json
+++ b/data/2026/125xxx/CVE-2026-125792.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.985Z",
"datePublished": "2026-11-13T14:44:46.614Z",
- "dateUpdated": "2026-11-13T14:45:47.454Z"
+ "dateUpdated": "2026-11-13T16:12:36.770Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:01:11.559797Z",
+ "id": "CVE-2026-125792",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:12:36.770Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125794.json b/data/2026/125xxx/CVE-2026-125794.json
index 1779f0966c..65d7c38407 100644
--- a/data/2026/125xxx/CVE-2026-125794.json
+++ b/data/2026/125xxx/CVE-2026-125794.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.985Z",
"datePublished": "2026-11-13T14:45:32.012Z",
- "dateUpdated": "2026-11-13T14:46:32.964Z"
+ "dateUpdated": "2026-11-13T16:00:29.538Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:32.702748Z",
+ "id": "CVE-2026-125794",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:29.538Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125800.json b/data/2026/125xxx/CVE-2026-125800.json
index 1de002cbe9..b265cbcf10 100644
--- a/data/2026/125xxx/CVE-2026-125800.json
+++ b/data/2026/125xxx/CVE-2026-125800.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.986Z",
"datePublished": "2026-11-13T13:16:41.564Z",
- "dateUpdated": "2026-11-13T13:16:41.564Z"
+ "dateUpdated": "2026-11-13T16:02:08.217Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:54.634774Z",
+ "id": "CVE-2026-125800",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:08.217Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125802.json b/data/2026/125xxx/CVE-2026-125802.json
index 29faf18940..e22575b44c 100644
--- a/data/2026/125xxx/CVE-2026-125802.json
+++ b/data/2026/125xxx/CVE-2026-125802.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.986Z",
"datePublished": "2026-11-13T14:49:06.308Z",
- "dateUpdated": "2026-11-13T14:49:06.755Z"
+ "dateUpdated": "2026-11-13T16:12:07.839Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:00:23.483315Z",
+ "id": "CVE-2026-125802",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:12:07.839Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125807.json b/data/2026/125xxx/CVE-2026-125807.json
index 5628a8d3a1..47328189ff 100644
--- a/data/2026/125xxx/CVE-2026-125807.json
+++ b/data/2026/125xxx/CVE-2026-125807.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.987Z",
"datePublished": "2026-11-13T14:38:08.242Z",
- "dateUpdated": "2026-11-13T14:38:08.621Z"
+ "dateUpdated": "2026-11-13T16:01:35.627Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:46.426054Z",
+ "id": "CVE-2026-125807",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:35.627Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125808.json b/data/2026/125xxx/CVE-2026-125808.json
index be6287446f..e962ba2669 100644
--- a/data/2026/125xxx/CVE-2026-125808.json
+++ b/data/2026/125xxx/CVE-2026-125808.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.987Z",
"datePublished": "2026-11-13T14:37:19.654Z",
- "dateUpdated": "2026-11-13T14:37:26.063Z"
+ "dateUpdated": "2026-11-13T16:14:21.250Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:02:41.586919Z",
+ "id": "CVE-2026-125808",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:14:21.250Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125809.json b/data/2026/125xxx/CVE-2026-125809.json
index 4a97941825..1c37ff8f31 100644
--- a/data/2026/125xxx/CVE-2026-125809.json
+++ b/data/2026/125xxx/CVE-2026-125809.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:41:21.896Z",
- "dateUpdated": "2026-11-13T14:42:22.792Z"
+ "dateUpdated": "2026-11-13T16:01:02.102Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:39.753613Z",
+ "id": "CVE-2026-125809",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:02.102Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125810.json b/data/2026/125xxx/CVE-2026-125810.json
index c2118e4148..3faff32e9b 100644
--- a/data/2026/125xxx/CVE-2026-125810.json
+++ b/data/2026/125xxx/CVE-2026-125810.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:41:40.114Z",
- "dateUpdated": "2026-11-13T14:42:41.233Z"
+ "dateUpdated": "2026-11-13T16:13:36.278Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:01:44.238778Z",
+ "id": "CVE-2026-125810",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:13:36.278Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125811.json b/data/2026/125xxx/CVE-2026-125811.json
index 0346710d14..f070c014bf 100644
--- a/data/2026/125xxx/CVE-2026-125811.json
+++ b/data/2026/125xxx/CVE-2026-125811.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T14:42:07.515Z",
- "dateUpdated": "2026-11-13T14:43:08.685Z"
+ "dateUpdated": "2026-11-13T16:13:21.838Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:01:37.061482Z",
+ "id": "CVE-2026-125811",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:13:21.838Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125816.json b/data/2026/125xxx/CVE-2026-125816.json
index b2000d9602..cf2f1f4a37 100644
--- a/data/2026/125xxx/CVE-2026-125816.json
+++ b/data/2026/125xxx/CVE-2026-125816.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.989Z",
"datePublished": "2026-11-13T13:03:44.155Z",
- "dateUpdated": "2026-11-13T13:04:43.817Z"
+ "dateUpdated": "2026-11-13T16:02:24.218Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:58.902733Z",
+ "id": "CVE-2026-125816",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:24.218Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125819.json b/data/2026/125xxx/CVE-2026-125819.json
index 18bad2df1f..b7f1617bf8 100644
--- a/data/2026/125xxx/CVE-2026-125819.json
+++ b/data/2026/125xxx/CVE-2026-125819.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.989Z",
"datePublished": "2026-11-13T14:36:42.484Z",
- "dateUpdated": "2026-11-13T14:37:43.070Z"
+ "dateUpdated": "2026-11-13T16:14:35.758Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:03:39.726191Z",
+ "id": "CVE-2026-125819",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:14:35.758Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125824.json b/data/2026/125xxx/CVE-2026-125824.json
index 7fc9c041b2..70bd41a5b2 100644
--- a/data/2026/125xxx/CVE-2026-125824.json
+++ b/data/2026/125xxx/CVE-2026-125824.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:37:01.016Z",
- "dateUpdated": "2026-11-13T14:38:01.756Z"
+ "dateUpdated": "2026-11-13T16:01:51.146Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:51.066926Z",
+ "id": "CVE-2026-125824",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:51.146Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125825.json b/data/2026/125xxx/CVE-2026-125825.json
index f407f1873c..6129228260 100644
--- a/data/2026/125xxx/CVE-2026-125825.json
+++ b/data/2026/125xxx/CVE-2026-125825.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:48:42.721Z",
- "dateUpdated": "2026-11-13T14:49:43.300Z"
+ "dateUpdated": "2026-11-13T16:12:22.283Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:00:47.482919Z",
+ "id": "CVE-2026-125825",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:12:22.283Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125827.json b/data/2026/125xxx/CVE-2026-125827.json
index 2e81079d5f..328cf460f7 100644
--- a/data/2026/125xxx/CVE-2026-125827.json
+++ b/data/2026/125xxx/CVE-2026-125827.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:42:34.956Z",
- "dateUpdated": "2026-11-13T14:43:36.205Z"
+ "dateUpdated": "2026-11-13T16:13:07.517Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:01:29.042417Z",
+ "id": "CVE-2026-125827",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:13:07.517Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125831.json b/data/2026/125xxx/CVE-2026-125831.json
index 534884e6e2..3b818c0057 100644
--- a/data/2026/125xxx/CVE-2026-125831.json
+++ b/data/2026/125xxx/CVE-2026-125831.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:44:06.958Z",
- "dateUpdated": "2026-11-13T14:45:08.045Z"
+ "dateUpdated": "2026-11-13T16:00:45.599Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:35.545065Z",
+ "id": "CVE-2026-125831",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:45.599Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125833.json b/data/2026/125xxx/CVE-2026-125833.json
index 171b4bd98f..128e5e3229 100644
--- a/data/2026/125xxx/CVE-2026-125833.json
+++ b/data/2026/125xxx/CVE-2026-125833.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T12:56:11.234Z",
- "dateUpdated": "2026-11-13T12:57:11.726Z"
+ "dateUpdated": "2026-11-13T16:02:39.742Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:58:03.770972Z",
+ "id": "CVE-2026-125833",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:39.742Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125834.json b/data/2026/125xxx/CVE-2026-125834.json
index d4ceca91a4..421a1a6a29 100644
--- a/data/2026/125xxx/CVE-2026-125834.json
+++ b/data/2026/125xxx/CVE-2026-125834.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T14:43:27.039Z",
- "dateUpdated": "2026-11-13T14:44:28.214Z"
+ "dateUpdated": "2026-11-13T16:12:51.780Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:01:20.262708Z",
+ "id": "CVE-2026-125834",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:12:51.780Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125835.json b/data/2026/125xxx/CVE-2026-125835.json
index 3d853a4ddd..fdcef42202 100644
--- a/data/2026/125xxx/CVE-2026-125835.json
+++ b/data/2026/125xxx/CVE-2026-125835.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T14:39:51.449Z",
- "dateUpdated": "2026-11-13T14:40:53.481Z"
+ "dateUpdated": "2026-11-13T16:01:19.159Z"
},
"containers": {
"cna": {
@@ -131,6 +131,40 @@
]
}
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:43.302732Z",
+ "id": "CVE-2026-125835",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:19.159Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125837.json b/data/2026/125xxx/CVE-2026-125837.json
index 9a36590b32..0a28ac0268 100644
--- a/data/2026/125xxx/CVE-2026-125837.json
+++ b/data/2026/125xxx/CVE-2026-125837.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-13T15:08:39.612Z",
- "dateUpdated": "2026-11-13T15:08:39.612Z"
+ "dateUpdated": "2026-11-13T15:59:55.766Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:26.244626Z",
+ "id": "CVE-2026-125837",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:55.766Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125851.json b/data/2026/125xxx/CVE-2026-125851.json
index 5e7b723df3..31756c6b85 100644
--- a/data/2026/125xxx/CVE-2026-125851.json
+++ b/data/2026/125xxx/CVE-2026-125851.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:40.381Z",
- "dateUpdated": "2026-11-13T15:08:40.381Z"
+ "dateUpdated": "2026-11-13T16:10:07.428Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:59:04.214993Z",
+ "id": "CVE-2026-125851",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:10:07.428Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125852.json b/data/2026/125xxx/CVE-2026-125852.json
index 0139dd4f52..c4b8b11042 100644
--- a/data/2026/125xxx/CVE-2026-125852.json
+++ b/data/2026/125xxx/CVE-2026-125852.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.232Z",
- "dateUpdated": "2026-11-13T15:08:39.232Z"
+ "dateUpdated": "2026-11-13T16:11:06.410Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:59:48.778974Z",
+ "id": "CVE-2026-125852",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:11:06.410Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125853.json b/data/2026/125xxx/CVE-2026-125853.json
index 0f0914734c..38c6aed4b9 100644
--- a/data/2026/125xxx/CVE-2026-125853.json
+++ b/data/2026/125xxx/CVE-2026-125853.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.265Z",
- "dateUpdated": "2026-11-13T15:08:39.265Z"
+ "dateUpdated": "2026-11-13T16:10:50.924Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:59:41.778917Z",
+ "id": "CVE-2026-125853",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:10:50.924Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125854.json b/data/2026/125xxx/CVE-2026-125854.json
index e8c0422c1d..8a0c7111ef 100644
--- a/data/2026/125xxx/CVE-2026-125854.json
+++ b/data/2026/125xxx/CVE-2026-125854.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.982Z",
- "dateUpdated": "2026-11-13T15:08:39.982Z"
+ "dateUpdated": "2026-11-13T15:59:39.273Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:22.667228Z",
+ "id": "CVE-2026-125854",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:39.273Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125855.json b/data/2026/125xxx/CVE-2026-125855.json
index 024a83069a..f29518d7ae 100644
--- a/data/2026/125xxx/CVE-2026-125855.json
+++ b/data/2026/125xxx/CVE-2026-125855.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:39.659Z",
- "dateUpdated": "2026-11-13T15:08:39.659Z"
+ "dateUpdated": "2026-11-13T16:10:36.398Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:59:31.214808Z",
+ "id": "CVE-2026-125855",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:10:36.398Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125856.json b/data/2026/125xxx/CVE-2026-125856.json
index 0fa85a595c..cfb27fd20a 100644
--- a/data/2026/125xxx/CVE-2026-125856.json
+++ b/data/2026/125xxx/CVE-2026-125856.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:40.002Z",
- "dateUpdated": "2026-11-13T15:08:40.002Z"
+ "dateUpdated": "2026-11-13T15:59:23.285Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:57:19.153570Z",
+ "id": "CVE-2026-125856",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:23.285Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/125xxx/CVE-2026-125858.json b/data/2026/125xxx/CVE-2026-125858.json
index 6af7e95cc9..1c211e8b5c 100644
--- a/data/2026/125xxx/CVE-2026-125858.json
+++ b/data/2026/125xxx/CVE-2026-125858.json
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.992Z",
"datePublished": "2026-11-13T15:08:40.361Z",
- "dateUpdated": "2026-11-13T15:08:40.361Z"
+ "dateUpdated": "2026-11-13T16:10:21.907Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:59:21.543049Z",
+ "id": "CVE-2026-125858",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:10:21.907Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126049.json b/data/2026/126xxx/CVE-2026-126049.json
index 65e382a237..ef04088612 100644
--- a/data/2026/126xxx/CVE-2026-126049.json
+++ b/data/2026/126xxx/CVE-2026-126049.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T16:53:12.633Z",
"datePublished": "2026-11-10T16:58:04.296Z",
- "dateUpdated": "2026-11-10T16:58:04.296Z"
+ "dateUpdated": "2026-11-13T15:27:55.046Z"
},
"containers": {
"cna": {
@@ -137,6 +137,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:27:41.189264Z",
+ "id": "CVE-2026-126049",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:27:55.046Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126063.json b/data/2026/126xxx/CVE-2026-126063.json
index 4f4fa92423..2f45edc465 100644
--- a/data/2026/126xxx/CVE-2026-126063.json
+++ b/data/2026/126xxx/CVE-2026-126063.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.283Z",
"datePublished": "2026-11-10T20:14:40.408Z",
- "dateUpdated": "2026-11-10T20:14:40.408Z"
+ "dateUpdated": "2026-11-13T15:51:43.029Z"
},
"containers": {
"cna": {
@@ -120,6 +120,40 @@
"advisory": "GHSA-4p39-36wj-23h4",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:49:25.822174Z",
+ "id": "CVE-2026-126063",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:51:43.029Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126067.json b/data/2026/126xxx/CVE-2026-126067.json
index f80999ba47..fa8e1625bb 100644
--- a/data/2026/126xxx/CVE-2026-126067.json
+++ b/data/2026/126xxx/CVE-2026-126067.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.283Z",
"datePublished": "2026-11-10T20:29:44.430Z",
- "dateUpdated": "2026-11-10T20:29:44.430Z"
+ "dateUpdated": "2026-11-13T16:00:26.328Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-gmj8-hvj3-49mw",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:56:36.588222Z",
+ "id": "CVE-2026-126067",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:26.328Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126071.json b/data/2026/126xxx/CVE-2026-126071.json
index b7570e1830..e69ff9ee9e 100644
--- a/data/2026/126xxx/CVE-2026-126071.json
+++ b/data/2026/126xxx/CVE-2026-126071.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.284Z",
"datePublished": "2026-11-10T20:40:37.197Z",
- "dateUpdated": "2026-11-10T20:40:37.197Z"
+ "dateUpdated": "2026-11-13T16:07:47.057Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-4v2w-w6g6-f8f8",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:05:22.732996Z",
+ "id": "CVE-2026-126071",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:07:47.057Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126074.json b/data/2026/126xxx/CVE-2026-126074.json
index b31040e798..9074e2400a 100644
--- a/data/2026/126xxx/CVE-2026-126074.json
+++ b/data/2026/126xxx/CVE-2026-126074.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.284Z",
"datePublished": "2026-11-10T20:48:25.207Z",
- "dateUpdated": "2026-11-10T20:48:25.207Z"
+ "dateUpdated": "2026-11-13T16:08:25.577Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-p2pm-g2h6-7j5j",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:08:01.643343Z",
+ "id": "CVE-2026-126074",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:08:25.577Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126079.json b/data/2026/126xxx/CVE-2026-126079.json
index f6c55253f8..f3bd6f930d 100644
--- a/data/2026/126xxx/CVE-2026-126079.json
+++ b/data/2026/126xxx/CVE-2026-126079.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T17:07:43.285Z",
"datePublished": "2026-11-10T21:02:30.667Z",
- "dateUpdated": "2026-11-10T21:02:30.667Z"
+ "dateUpdated": "2026-11-13T16:12:01.279Z"
},
"containers": {
"cna": {
@@ -111,6 +111,40 @@
"advisory": "GHSA-2p2f-4rq4-gjwc",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:11:45.399950Z",
+ "id": "CVE-2026-126079",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:12:01.279Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126274.json b/data/2026/126xxx/CVE-2026-126274.json
index 5350c8b4fb..dfaad9ecba 100644
--- a/data/2026/126xxx/CVE-2026-126274.json
+++ b/data/2026/126xxx/CVE-2026-126274.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.971Z",
"datePublished": "2026-11-13T09:36:44.396Z",
- "dateUpdated": "2026-11-13T09:36:44.396Z"
+ "dateUpdated": "2026-11-13T15:53:19.105Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:37.552966Z",
+ "id": "CVE-2026-126274",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:19.105Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126282.json b/data/2026/126xxx/CVE-2026-126282.json
index 6165d155ab..9de1b920fa 100644
--- a/data/2026/126xxx/CVE-2026-126282.json
+++ b/data/2026/126xxx/CVE-2026-126282.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:37.841Z",
- "dateUpdated": "2026-11-13T09:36:37.841Z"
+ "dateUpdated": "2026-11-13T15:53:26.198Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:35.354163Z",
+ "id": "CVE-2026-126282",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:26.198Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126290.json b/data/2026/126xxx/CVE-2026-126290.json
index 7e5ccf384e..a6efc01ebf 100644
--- a/data/2026/126xxx/CVE-2026-126290.json
+++ b/data/2026/126xxx/CVE-2026-126290.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:32.519Z",
- "dateUpdated": "2026-11-13T09:36:32.519Z"
+ "dateUpdated": "2026-11-13T15:53:32.854Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:47.817569Z",
+ "id": "CVE-2026-126290",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:32.854Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126302.json b/data/2026/126xxx/CVE-2026-126302.json
index 61c6713982..706e5e32df 100644
--- a/data/2026/126xxx/CVE-2026-126302.json
+++ b/data/2026/126xxx/CVE-2026-126302.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.613Z",
"datePublished": "2026-11-13T09:36:24.559Z",
- "dateUpdated": "2026-11-13T09:36:24.559Z"
+ "dateUpdated": "2026-11-13T15:53:40.495Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:45.468470Z",
+ "id": "CVE-2026-126302",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:40.495Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126306.json b/data/2026/126xxx/CVE-2026-126306.json
index fcef4ceb40..07b5243cf4 100644
--- a/data/2026/126xxx/CVE-2026-126306.json
+++ b/data/2026/126xxx/CVE-2026-126306.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:21.753Z",
- "dateUpdated": "2026-11-13T09:36:21.753Z"
+ "dateUpdated": "2026-11-13T15:53:50.304Z"
},
"containers": {
"cna": {
@@ -173,6 +173,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:32.944519Z",
+ "id": "CVE-2026-126306",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:50.304Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126310.json b/data/2026/126xxx/CVE-2026-126310.json
index 68a416217d..4f18fa1f02 100644
--- a/data/2026/126xxx/CVE-2026-126310.json
+++ b/data/2026/126xxx/CVE-2026-126310.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:18.944Z",
- "dateUpdated": "2026-11-13T09:36:18.944Z"
+ "dateUpdated": "2026-11-13T15:53:58.886Z"
},
"containers": {
"cna": {
@@ -162,6 +162,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:42.686794Z",
+ "id": "CVE-2026-126310",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:58.886Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126314.json b/data/2026/126xxx/CVE-2026-126314.json
index 26f02ff447..ce2d6c3789 100644
--- a/data/2026/126xxx/CVE-2026-126314.json
+++ b/data/2026/126xxx/CVE-2026-126314.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.991Z",
"datePublished": "2026-11-13T09:36:16.153Z",
- "dateUpdated": "2026-11-13T09:36:16.153Z"
+ "dateUpdated": "2026-11-13T15:54:06.538Z"
},
"containers": {
"cna": {
@@ -152,6 +152,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:30.766203Z",
+ "id": "CVE-2026-126314",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:06.538Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126318.json b/data/2026/126xxx/CVE-2026-126318.json
index c1e7c20540..f5c3cd10f4 100644
--- a/data/2026/126xxx/CVE-2026-126318.json
+++ b/data/2026/126xxx/CVE-2026-126318.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:13.376Z",
- "dateUpdated": "2026-11-13T09:36:13.376Z"
+ "dateUpdated": "2026-11-13T15:54:13.178Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:40.490307Z",
+ "id": "CVE-2026-126318",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:13.178Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126322.json b/data/2026/126xxx/CVE-2026-126322.json
index c7eb8f6770..ef5ceb4a6c 100644
--- a/data/2026/126xxx/CVE-2026-126322.json
+++ b/data/2026/126xxx/CVE-2026-126322.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:10.583Z",
- "dateUpdated": "2026-11-13T09:36:10.583Z"
+ "dateUpdated": "2026-11-13T15:54:19.608Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:28.271619Z",
+ "id": "CVE-2026-126322",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:19.608Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126346.json b/data/2026/126xxx/CVE-2026-126346.json
index 5d5de0c046..bea1b88c8c 100644
--- a/data/2026/126xxx/CVE-2026-126346.json
+++ b/data/2026/126xxx/CVE-2026-126346.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.227Z",
"datePublished": "2026-11-12T21:42:09.509Z",
- "dateUpdated": "2026-11-12T21:42:09.509Z"
+ "dateUpdated": "2026-11-13T16:03:49.107Z"
},
"containers": {
"cna": {
@@ -103,6 +103,40 @@
"advisory": "GHSA-r4jh-29pc-gfqr",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:28:48.090634Z",
+ "id": "CVE-2026-126346",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:03:49.107Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126350.json b/data/2026/126xxx/CVE-2026-126350.json
index 1f2586c496..ec3b33c583 100644
--- a/data/2026/126xxx/CVE-2026-126350.json
+++ b/data/2026/126xxx/CVE-2026-126350.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.227Z",
"datePublished": "2026-11-12T22:04:01.521Z",
- "dateUpdated": "2026-11-12T22:04:01.521Z"
+ "dateUpdated": "2026-11-13T16:03:39.613Z"
},
"containers": {
"cna": {
@@ -100,6 +100,40 @@
"advisory": "GHSA-j82w-28jv-3pmj",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:28:50.373815Z",
+ "id": "CVE-2026-126350",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:03:39.613Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126354.json b/data/2026/126xxx/CVE-2026-126354.json
index c2e2c5b9c6..f32cd83859 100644
--- a/data/2026/126xxx/CVE-2026-126354.json
+++ b/data/2026/126xxx/CVE-2026-126354.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.227Z",
"datePublished": "2026-11-12T22:11:07.965Z",
- "dateUpdated": "2026-11-12T22:11:07.965Z"
+ "dateUpdated": "2026-11-13T16:03:31.478Z"
},
"containers": {
"cna": {
@@ -103,6 +103,40 @@
"advisory": "GHSA-8gmh-2hhj-2hv9",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:28:52.994631Z",
+ "id": "CVE-2026-126354",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:03:31.478Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126362.json b/data/2026/126xxx/CVE-2026-126362.json
index 13dd442286..dcc7a4fb4b 100644
--- a/data/2026/126xxx/CVE-2026-126362.json
+++ b/data/2026/126xxx/CVE-2026-126362.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-10T21:12:01.228Z",
"datePublished": "2026-11-12T22:29:19.505Z",
- "dateUpdated": "2026-11-12T22:29:19.505Z"
+ "dateUpdated": "2026-11-13T16:03:23.174Z"
},
"containers": {
"cna": {
@@ -96,6 +96,40 @@
"advisory": "GHSA-f4j9-crrj-867q",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:28:56.006808Z",
+ "id": "CVE-2026-126362",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:03:23.174Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126371.json b/data/2026/126xxx/CVE-2026-126371.json
index e592266b6d..1acdbb279b 100644
--- a/data/2026/126xxx/CVE-2026-126371.json
+++ b/data/2026/126xxx/CVE-2026-126371.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:07.876Z",
- "dateUpdated": "2026-11-13T09:36:07.876Z"
+ "dateUpdated": "2026-11-13T15:54:27.401Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:37.892980Z",
+ "id": "CVE-2026-126371",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:27.401Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126375.json b/data/2026/126xxx/CVE-2026-126375.json
index 14e6ea5cf3..bbeefd602e 100644
--- a/data/2026/126xxx/CVE-2026-126375.json
+++ b/data/2026/126xxx/CVE-2026-126375.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.550Z",
"datePublished": "2026-11-13T09:36:05.220Z",
- "dateUpdated": "2026-11-13T09:36:05.220Z"
+ "dateUpdated": "2026-11-13T15:54:33.514Z"
},
"containers": {
"cna": {
@@ -127,6 +127,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:35.463576Z",
+ "id": "CVE-2026-126375",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:33.514Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126379.json b/data/2026/126xxx/CVE-2026-126379.json
index c3d274ef85..279d4a37f8 100644
--- a/data/2026/126xxx/CVE-2026-126379.json
+++ b/data/2026/126xxx/CVE-2026-126379.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:26:25.841Z",
"datePublished": "2026-11-13T09:36:02.526Z",
- "dateUpdated": "2026-11-13T09:36:02.526Z"
+ "dateUpdated": "2026-11-13T15:54:39.838Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:33.225669Z",
+ "id": "CVE-2026-126379",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:39.838Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126383.json b/data/2026/126xxx/CVE-2026-126383.json
index 42aadd17eb..33de34774a 100644
--- a/data/2026/126xxx/CVE-2026-126383.json
+++ b/data/2026/126xxx/CVE-2026-126383.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:26:25.841Z",
"datePublished": "2026-11-13T09:35:59.797Z",
- "dateUpdated": "2026-11-13T09:35:59.797Z"
+ "dateUpdated": "2026-11-13T15:54:47.120Z"
},
"containers": {
"cna": {
@@ -245,6 +245,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:31.007922Z",
+ "id": "CVE-2026-126383",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:47.120Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126387.json b/data/2026/126xxx/CVE-2026-126387.json
index 6fee29f437..e370e9d9d1 100644
--- a/data/2026/126xxx/CVE-2026-126387.json
+++ b/data/2026/126xxx/CVE-2026-126387.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:26:25.841Z",
"datePublished": "2026-11-13T09:35:57.075Z",
- "dateUpdated": "2026-11-13T09:35:57.075Z"
+ "dateUpdated": "2026-11-13T15:54:54.223Z"
},
"containers": {
"cna": {
@@ -210,6 +210,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:28.555758Z",
+ "id": "CVE-2026-126387",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:54:54.223Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126391.json b/data/2026/126xxx/CVE-2026-126391.json
index c90d8e19f0..d865456b6c 100644
--- a/data/2026/126xxx/CVE-2026-126391.json
+++ b/data/2026/126xxx/CVE-2026-126391.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:30:16.910Z",
"datePublished": "2026-11-13T09:35:54.388Z",
- "dateUpdated": "2026-11-13T09:35:54.388Z"
+ "dateUpdated": "2026-11-13T15:55:01.114Z"
},
"containers": {
"cna": {
@@ -250,6 +250,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:25.992622Z",
+ "id": "CVE-2026-126391",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:01.114Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126399.json b/data/2026/126xxx/CVE-2026-126399.json
index 8ed45d601a..3f66581c98 100644
--- a/data/2026/126xxx/CVE-2026-126399.json
+++ b/data/2026/126xxx/CVE-2026-126399.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:32:21.764Z",
"datePublished": "2026-11-13T09:35:48.994Z",
- "dateUpdated": "2026-11-13T09:35:48.994Z"
+ "dateUpdated": "2026-11-13T15:55:11.981Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:26.279127Z",
+ "id": "CVE-2026-126399",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:11.981Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126403.json b/data/2026/126xxx/CVE-2026-126403.json
index 9e52fd7fab..9d750ef70d 100644
--- a/data/2026/126xxx/CVE-2026-126403.json
+++ b/data/2026/126xxx/CVE-2026-126403.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:32:21.765Z",
"datePublished": "2026-11-13T09:35:46.335Z",
- "dateUpdated": "2026-11-13T09:35:46.335Z"
+ "dateUpdated": "2026-11-13T15:55:21.571Z"
},
"containers": {
"cna": {
@@ -316,6 +316,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:23.703298Z",
+ "id": "CVE-2026-126403",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:21.571Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126407.json b/data/2026/126xxx/CVE-2026-126407.json
index 1bbe0a023e..6a97d3f1a7 100644
--- a/data/2026/126xxx/CVE-2026-126407.json
+++ b/data/2026/126xxx/CVE-2026-126407.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:32:21.765Z",
"datePublished": "2026-11-13T09:35:43.638Z",
- "dateUpdated": "2026-11-13T09:35:43.638Z"
+ "dateUpdated": "2026-11-13T15:55:30.553Z"
},
"containers": {
"cna": {
@@ -238,6 +238,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:23.930509Z",
+ "id": "CVE-2026-126407",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:30.553Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126411.json b/data/2026/126xxx/CVE-2026-126411.json
index 9d67b5977c..7349f17633 100644
--- a/data/2026/126xxx/CVE-2026-126411.json
+++ b/data/2026/126xxx/CVE-2026-126411.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:34:05.396Z",
"datePublished": "2026-11-13T09:35:40.765Z",
- "dateUpdated": "2026-11-13T09:35:40.765Z"
+ "dateUpdated": "2026-11-13T15:55:36.363Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:21.666479Z",
+ "id": "CVE-2026-126411",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:36.363Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126415.json b/data/2026/126xxx/CVE-2026-126415.json
index 8f930de8b3..3754390c68 100644
--- a/data/2026/126xxx/CVE-2026-126415.json
+++ b/data/2026/126xxx/CVE-2026-126415.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:34:05.396Z",
"datePublished": "2026-11-13T09:35:37.169Z",
- "dateUpdated": "2026-11-13T09:35:37.169Z"
+ "dateUpdated": "2026-11-13T15:55:43.903Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:19.342747Z",
+ "id": "CVE-2026-126415",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:43.903Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126419.json b/data/2026/126xxx/CVE-2026-126419.json
index 7b848f2cfb..a1a1e0a686 100644
--- a/data/2026/126xxx/CVE-2026-126419.json
+++ b/data/2026/126xxx/CVE-2026-126419.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:36:07.090Z",
"datePublished": "2026-11-13T09:35:34.434Z",
- "dateUpdated": "2026-11-13T09:35:34.434Z"
+ "dateUpdated": "2026-11-13T15:55:51.950Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:16.858711Z",
+ "id": "CVE-2026-126419",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:51.950Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126423.json b/data/2026/126xxx/CVE-2026-126423.json
index b68aedde1d..ef6d04f9f3 100644
--- a/data/2026/126xxx/CVE-2026-126423.json
+++ b/data/2026/126xxx/CVE-2026-126423.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:36:07.090Z",
"datePublished": "2026-11-13T09:35:31.761Z",
- "dateUpdated": "2026-11-13T09:35:31.761Z"
+ "dateUpdated": "2026-11-13T15:55:59.971Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:13.820205Z",
+ "id": "CVE-2026-126423",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:55:59.971Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126427.json b/data/2026/126xxx/CVE-2026-126427.json
index 1e60a67c93..3ac48763f5 100644
--- a/data/2026/126xxx/CVE-2026-126427.json
+++ b/data/2026/126xxx/CVE-2026-126427.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:36:07.090Z",
"datePublished": "2026-11-13T09:35:29.043Z",
- "dateUpdated": "2026-11-13T09:35:29.043Z"
+ "dateUpdated": "2026-11-13T15:56:10.054Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:10.870766Z",
+ "id": "CVE-2026-126427",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:10.054Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126431.json b/data/2026/126xxx/CVE-2026-126431.json
index 7b3e52798f..6401f23607 100644
--- a/data/2026/126xxx/CVE-2026-126431.json
+++ b/data/2026/126xxx/CVE-2026-126431.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:37:25.685Z",
"datePublished": "2026-11-13T09:35:26.326Z",
- "dateUpdated": "2026-11-13T09:35:26.326Z"
+ "dateUpdated": "2026-11-13T15:56:18.082Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:21.059965Z",
+ "id": "CVE-2026-126431",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:18.082Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126435.json b/data/2026/126xxx/CVE-2026-126435.json
index 0afae7af9d..28e1efc608 100644
--- a/data/2026/126xxx/CVE-2026-126435.json
+++ b/data/2026/126xxx/CVE-2026-126435.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:37:25.685Z",
"datePublished": "2026-11-13T09:35:23.578Z",
- "dateUpdated": "2026-11-13T09:35:23.578Z"
+ "dateUpdated": "2026-11-13T15:56:26.369Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:08.335864Z",
+ "id": "CVE-2026-126435",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:26.369Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126439.json b/data/2026/126xxx/CVE-2026-126439.json
index 281e9a6897..88589b73e0 100644
--- a/data/2026/126xxx/CVE-2026-126439.json
+++ b/data/2026/126xxx/CVE-2026-126439.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:38:36.342Z",
"datePublished": "2026-11-13T09:35:20.845Z",
- "dateUpdated": "2026-11-13T09:35:20.845Z"
+ "dateUpdated": "2026-11-13T15:56:33.102Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:05.813167Z",
+ "id": "CVE-2026-126439",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:33.102Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126443.json b/data/2026/126xxx/CVE-2026-126443.json
index da9a9a026e..a475012334 100644
--- a/data/2026/126xxx/CVE-2026-126443.json
+++ b/data/2026/126xxx/CVE-2026-126443.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:38:36.342Z",
"datePublished": "2026-11-13T09:35:18.169Z",
- "dateUpdated": "2026-11-13T09:35:18.169Z"
+ "dateUpdated": "2026-11-13T15:56:40.944Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:00.760097Z",
+ "id": "CVE-2026-126443",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:40.944Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126447.json b/data/2026/126xxx/CVE-2026-126447.json
index 2fa41ba0d2..b8e6933c77 100644
--- a/data/2026/126xxx/CVE-2026-126447.json
+++ b/data/2026/126xxx/CVE-2026-126447.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:38:36.343Z",
"datePublished": "2026-11-13T09:35:15.502Z",
- "dateUpdated": "2026-11-13T09:35:15.502Z"
+ "dateUpdated": "2026-11-13T15:56:56.416Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:56.193811Z",
+ "id": "CVE-2026-126447",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:56:56.416Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126451.json b/data/2026/126xxx/CVE-2026-126451.json
index 1b40e4c936..05b26e5b4c 100644
--- a/data/2026/126xxx/CVE-2026-126451.json
+++ b/data/2026/126xxx/CVE-2026-126451.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:39:26.377Z",
"datePublished": "2026-11-13T09:35:12.702Z",
- "dateUpdated": "2026-11-13T09:35:12.702Z"
+ "dateUpdated": "2026-11-13T15:57:05.173Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:18.789189Z",
+ "id": "CVE-2026-126451",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:57:05.173Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126455.json b/data/2026/126xxx/CVE-2026-126455.json
index b4a5574f99..75589fb144 100644
--- a/data/2026/126xxx/CVE-2026-126455.json
+++ b/data/2026/126xxx/CVE-2026-126455.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:39:26.377Z",
"datePublished": "2026-11-13T09:35:09.982Z",
- "dateUpdated": "2026-11-13T09:35:09.982Z"
+ "dateUpdated": "2026-11-13T15:57:19.934Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:16.538512Z",
+ "id": "CVE-2026-126455",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:57:19.934Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126460.json b/data/2026/126xxx/CVE-2026-126460.json
index 1c3052d3a9..1991724844 100644
--- a/data/2026/126xxx/CVE-2026-126460.json
+++ b/data/2026/126xxx/CVE-2026-126460.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:41:28.742Z",
"datePublished": "2026-11-13T09:35:07.214Z",
- "dateUpdated": "2026-11-13T09:35:07.214Z"
+ "dateUpdated": "2026-11-13T15:57:29.893Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:53.686802Z",
+ "id": "CVE-2026-126460",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:57:29.893Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126464.json b/data/2026/126xxx/CVE-2026-126464.json
index 63a49fc858..d5b8b19cd6 100644
--- a/data/2026/126xxx/CVE-2026-126464.json
+++ b/data/2026/126xxx/CVE-2026-126464.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:41:28.743Z",
"datePublished": "2026-11-13T09:35:04.627Z",
- "dateUpdated": "2026-11-13T09:35:04.627Z"
+ "dateUpdated": "2026-11-13T15:58:07.952Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:50.299608Z",
+ "id": "CVE-2026-126464",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:07.952Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126468.json b/data/2026/126xxx/CVE-2026-126468.json
index b7ec9e7ccb..a401f21979 100644
--- a/data/2026/126xxx/CVE-2026-126468.json
+++ b/data/2026/126xxx/CVE-2026-126468.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:41:28.743Z",
"datePublished": "2026-11-13T09:35:01.841Z",
- "dateUpdated": "2026-11-13T09:35:01.841Z"
+ "dateUpdated": "2026-11-13T15:58:16.664Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:14.126294Z",
+ "id": "CVE-2026-126468",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:16.664Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126472.json b/data/2026/126xxx/CVE-2026-126472.json
index 4e962e809f..7d867337ab 100644
--- a/data/2026/126xxx/CVE-2026-126472.json
+++ b/data/2026/126xxx/CVE-2026-126472.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:42:24.800Z",
"datePublished": "2026-11-13T09:34:59.148Z",
- "dateUpdated": "2026-11-13T09:34:59.148Z"
+ "dateUpdated": "2026-11-13T15:58:24.286Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:11.855427Z",
+ "id": "CVE-2026-126472",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:24.286Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126476.json b/data/2026/126xxx/CVE-2026-126476.json
index 8a69167fcf..73c69d8c94 100644
--- a/data/2026/126xxx/CVE-2026-126476.json
+++ b/data/2026/126xxx/CVE-2026-126476.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:42:24.800Z",
"datePublished": "2026-11-13T09:34:56.473Z",
- "dateUpdated": "2026-11-13T09:34:56.473Z"
+ "dateUpdated": "2026-11-13T15:58:32.772Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:47.847781Z",
+ "id": "CVE-2026-126476",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:32.772Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126480.json b/data/2026/126xxx/CVE-2026-126480.json
index af3cb7ca25..86cbdf8275 100644
--- a/data/2026/126xxx/CVE-2026-126480.json
+++ b/data/2026/126xxx/CVE-2026-126480.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:44:28.725Z",
"datePublished": "2026-11-13T09:34:53.694Z",
- "dateUpdated": "2026-11-13T09:34:53.694Z"
+ "dateUpdated": "2026-11-13T15:58:41.524Z"
},
"containers": {
"cna": {
@@ -149,6 +149,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:09.432068Z",
+ "id": "CVE-2026-126480",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:41.524Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126484.json b/data/2026/126xxx/CVE-2026-126484.json
index 2dac7ccab2..8488e5f20f 100644
--- a/data/2026/126xxx/CVE-2026-126484.json
+++ b/data/2026/126xxx/CVE-2026-126484.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:44:28.726Z",
"datePublished": "2026-11-13T09:34:50.915Z",
- "dateUpdated": "2026-11-13T09:34:50.915Z"
+ "dateUpdated": "2026-11-13T15:58:53.506Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:45.472489Z",
+ "id": "CVE-2026-126484",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:58:53.506Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126488.json b/data/2026/126xxx/CVE-2026-126488.json
index 46ae2358f2..e83f45d9cb 100644
--- a/data/2026/126xxx/CVE-2026-126488.json
+++ b/data/2026/126xxx/CVE-2026-126488.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:44:28.726Z",
"datePublished": "2026-11-13T09:34:47.993Z",
- "dateUpdated": "2026-11-13T09:34:47.993Z"
+ "dateUpdated": "2026-11-13T15:59:03.735Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:43.032061Z",
+ "id": "CVE-2026-126488",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:03.735Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126492.json b/data/2026/126xxx/CVE-2026-126492.json
index 7ad6fdeedd..a8fdd4527f 100644
--- a/data/2026/126xxx/CVE-2026-126492.json
+++ b/data/2026/126xxx/CVE-2026-126492.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:45:21.806Z",
"datePublished": "2026-11-13T09:34:43.205Z",
- "dateUpdated": "2026-11-13T09:34:43.205Z"
+ "dateUpdated": "2026-11-13T15:59:14.372Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:40.673448Z",
+ "id": "CVE-2026-126492",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:14.372Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126817.json b/data/2026/126xxx/CVE-2026-126817.json
new file mode 100644
index 0000000000..e0b5b3db8f
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126817.json
@@ -0,0 +1,201 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-126817",
+ "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
+ "state": "PUBLISHED",
+ "assignerShortName": "mongodb",
+ "dateReserved": "2026-11-11T20:06:23.925Z",
+ "datePublished": "2026-11-13T15:40:10.838Z",
+ "dateUpdated": "2026-11-13T15:40:10.838Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
+ "shortName": "mongodb",
+ "dateUpdated": "2026-11-13T15:40:10.838Z"
+ },
+ "title": "Mongoid stores encrypted fields in plaintext when two models share a collection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-312",
+ "description": "CWE-312: Cleartext Storage of Sensitive Information",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "MongoDB",
+ "product": "Ruby Driver",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "9.0.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.1",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.2",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.3",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.4",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.5",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.6",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.7",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.8",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.9",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.10",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.11",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.12",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.1.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.1.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://jira.mongodb.org/browse/MONGOID-6037"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "PRESENT",
+ "privilegesRequired": "LOW",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+ }
+ },
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "LOW",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+ }
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "x_generator": {
+ "engine": "Vulnogram 1.0.5"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126818.json b/data/2026/126xxx/CVE-2026-126818.json
new file mode 100644
index 0000000000..b1ed7e6e97
--- /dev/null
+++ b/data/2026/126xxx/CVE-2026-126818.json
@@ -0,0 +1,201 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-126818",
+ "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
+ "state": "PUBLISHED",
+ "assignerShortName": "mongodb",
+ "dateReserved": "2026-11-11T20:19:00.200Z",
+ "datePublished": "2026-11-13T15:42:15.179Z",
+ "dateUpdated": "2026-11-13T15:42:15.179Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
+ "shortName": "mongodb",
+ "dateUpdated": "2026-11-13T15:42:15.179Z"
+ },
+ "title": "Mongoid 9.1.1 incomplete CVE-2026-93764 fix stores descendant-only encrypted fields in plaintext",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-311",
+ "description": "CWE-311: Missing Encryption of Sensitive Data",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "MongoDB",
+ "product": "Ruby Driver",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "9.0.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.1",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.2",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.3",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.4",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.5",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.6",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.7",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.8",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.9",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.10",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.11",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.0.12",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.1.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "9.1.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://jira.mongodb.org/browse/MONGOID-6037"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "LOW",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "HIGH",
+ "baseScore": 7.1,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+ }
+ },
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "LOW",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+ }
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "x_generator": {
+ "engine": "Vulnogram 1.0.5"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126831.json b/data/2026/126xxx/CVE-2026-126831.json
index 9321651d89..e2ca484a97 100644
--- a/data/2026/126xxx/CVE-2026-126831.json
+++ b/data/2026/126xxx/CVE-2026-126831.json
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-11T21:04:08.843Z",
"datePublished": "2026-11-12T17:27:16.588Z",
- "dateUpdated": "2026-11-12T17:27:16.588Z"
+ "dateUpdated": "2026-11-13T15:40:46.559Z"
},
"containers": {
"cna": {
@@ -160,6 +160,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:40:33.975265Z",
+ "id": "CVE-2026-126831",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:40:46.559Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126937.json b/data/2026/126xxx/CVE-2026-126937.json
index f8619bdf03..37de3b8147 100644
--- a/data/2026/126xxx/CVE-2026-126937.json
+++ b/data/2026/126xxx/CVE-2026-126937.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:56:41.844Z",
"datePublished": "2026-11-13T09:34:40.499Z",
- "dateUpdated": "2026-11-13T09:34:40.499Z"
+ "dateUpdated": "2026-11-13T15:59:25.102Z"
},
"containers": {
"cna": {
@@ -127,6 +127,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:07.043773Z",
+ "id": "CVE-2026-126937",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:25.102Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126941.json b/data/2026/126xxx/CVE-2026-126941.json
index 7982cb08c5..27e53f601f 100644
--- a/data/2026/126xxx/CVE-2026-126941.json
+++ b/data/2026/126xxx/CVE-2026-126941.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:56:41.844Z",
"datePublished": "2026-11-13T09:34:37.786Z",
- "dateUpdated": "2026-11-13T09:34:37.786Z"
+ "dateUpdated": "2026-11-13T15:59:32.819Z"
},
"containers": {
"cna": {
@@ -117,6 +117,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:38.336434Z",
+ "id": "CVE-2026-126941",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:32.819Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126945.json b/data/2026/126xxx/CVE-2026-126945.json
index ce9019f6bc..abec406ed2 100644
--- a/data/2026/126xxx/CVE-2026-126945.json
+++ b/data/2026/126xxx/CVE-2026-126945.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:56:41.844Z",
"datePublished": "2026-11-13T09:34:35.069Z",
- "dateUpdated": "2026-11-13T09:34:35.069Z"
+ "dateUpdated": "2026-11-13T15:59:45.667Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:04.774804Z",
+ "id": "CVE-2026-126945",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:59:45.667Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126947.json b/data/2026/126xxx/CVE-2026-126947.json
index 6bec6b34c5..a9327bb33f 100644
--- a/data/2026/126xxx/CVE-2026-126947.json
+++ b/data/2026/126xxx/CVE-2026-126947.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:57:48.492Z",
"datePublished": "2026-11-13T09:34:33.705Z",
- "dateUpdated": "2026-11-13T09:34:33.705Z"
+ "dateUpdated": "2026-11-13T16:00:00.244Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:35.972472Z",
+ "id": "CVE-2026-126947",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:00.244Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/126xxx/CVE-2026-126951.json b/data/2026/126xxx/CVE-2026-126951.json
index eeecb6047a..c5f1650a38 100644
--- a/data/2026/126xxx/CVE-2026-126951.json
+++ b/data/2026/126xxx/CVE-2026-126951.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:57:48.492Z",
"datePublished": "2026-11-13T09:34:30.968Z",
- "dateUpdated": "2026-11-13T09:34:30.968Z"
+ "dateUpdated": "2026-11-13T16:00:14.856Z"
},
"containers": {
"cna": {
@@ -100,6 +100,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:33.718774Z",
+ "id": "CVE-2026-126951",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:14.856Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127084.json b/data/2026/127xxx/CVE-2026-127084.json
index 102baca1db..c653d00663 100644
--- a/data/2026/127xxx/CVE-2026-127084.json
+++ b/data/2026/127xxx/CVE-2026-127084.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T14:14:13.578Z",
"datePublished": "2026-11-13T09:34:18.830Z",
- "dateUpdated": "2026-11-13T09:34:18.830Z"
+ "dateUpdated": "2026-11-13T16:00:25.966Z"
},
"containers": {
"cna": {
@@ -153,6 +153,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:01.553879Z",
+ "id": "CVE-2026-127084",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:25.966Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127093.json b/data/2026/127xxx/CVE-2026-127093.json
index da2237dd10..86686f44c6 100644
--- a/data/2026/127xxx/CVE-2026-127093.json
+++ b/data/2026/127xxx/CVE-2026-127093.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T14:18:17.723Z",
"datePublished": "2026-11-13T09:34:13.400Z",
- "dateUpdated": "2026-11-13T09:34:13.400Z"
+ "dateUpdated": "2026-11-13T16:00:36.839Z"
},
"containers": {
"cna": {
@@ -150,6 +150,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:31.376153Z",
+ "id": "CVE-2026-127093",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:36.839Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/127xxx/CVE-2026-127094.json b/data/2026/127xxx/CVE-2026-127094.json
index 5ce1aae155..f2d7035abc 100644
--- a/data/2026/127xxx/CVE-2026-127094.json
+++ b/data/2026/127xxx/CVE-2026-127094.json
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T14:27:04.667Z",
"datePublished": "2026-11-13T09:34:12.707Z",
- "dateUpdated": "2026-11-13T09:34:12.707Z"
+ "dateUpdated": "2026-11-13T15:42:33.224Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
- "dateUpdated": "2026-11-13T09:34:12.707Z"
+ "dateUpdated": "2026-11-13T15:42:33.224Z"
},
"datePublic": "2026-10-01T00:00:00.000Z",
"title": "Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API",
@@ -112,6 +112,12 @@
"technical-description"
]
},
+ {
+ "url": "https://lazytitan.ro/pagelayer",
+ "tags": [
+ "technical-description"
+ ]
+ },
{
"name": "VulnCheck Advisory: Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API",
"tags": [
diff --git a/data/2026/127xxx/CVE-2026-127208.json b/data/2026/127xxx/CVE-2026-127208.json
index b42880ddc9..96921864ab 100644
--- a/data/2026/127xxx/CVE-2026-127208.json
+++ b/data/2026/127xxx/CVE-2026-127208.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T16:30:10.903Z",
"datePublished": "2026-11-12T20:58:59.634Z",
- "dateUpdated": "2026-11-12T20:58:59.634Z"
+ "dateUpdated": "2026-11-13T16:04:00.401Z"
},
"containers": {
"cna": {
@@ -149,6 +149,40 @@
"x_generator": {
"engine": "vulncheck"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:34:54.409817Z",
+ "id": "CVE-2026-127208",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:04:00.401Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128016.json b/data/2026/128xxx/CVE-2026-128016.json
index 59a14a1a72..671dcbbb31 100644
--- a/data/2026/128xxx/CVE-2026-128016.json
+++ b/data/2026/128xxx/CVE-2026-128016.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:32:53.532Z",
"datePublished": "2026-11-13T09:34:10.667Z",
- "dateUpdated": "2026-11-13T09:34:10.667Z"
+ "dateUpdated": "2026-11-13T16:00:46.891Z"
},
"containers": {
"cna": {
@@ -147,6 +147,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:29.060551Z",
+ "id": "CVE-2026-128016",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:46.891Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128020.json b/data/2026/128xxx/CVE-2026-128020.json
index 5d8268c94e..626e2aa217 100644
--- a/data/2026/128xxx/CVE-2026-128020.json
+++ b/data/2026/128xxx/CVE-2026-128020.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:32:53.532Z",
"datePublished": "2026-11-13T09:34:07.894Z",
- "dateUpdated": "2026-11-13T09:34:07.894Z"
+ "dateUpdated": "2026-11-13T16:00:58.796Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:26.503479Z",
+ "id": "CVE-2026-128020",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:00:58.796Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128024.json b/data/2026/128xxx/CVE-2026-128024.json
index 8fc46a4226..9099e90ae6 100644
--- a/data/2026/128xxx/CVE-2026-128024.json
+++ b/data/2026/128xxx/CVE-2026-128024.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:33:43.124Z",
"datePublished": "2026-11-13T09:34:05.162Z",
- "dateUpdated": "2026-11-13T09:34:05.162Z"
+ "dateUpdated": "2026-11-13T16:01:10.703Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:23.846351Z",
+ "id": "CVE-2026-128024",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:10.703Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128028.json b/data/2026/128xxx/CVE-2026-128028.json
index 2d19c1386a..ca58ff03df 100644
--- a/data/2026/128xxx/CVE-2026-128028.json
+++ b/data/2026/128xxx/CVE-2026-128028.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:33:43.125Z",
"datePublished": "2026-11-13T09:34:02.436Z",
- "dateUpdated": "2026-11-13T09:34:02.436Z"
+ "dateUpdated": "2026-11-13T16:01:21.344Z"
},
"containers": {
"cna": {
@@ -161,6 +161,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:20.984848Z",
+ "id": "CVE-2026-128028",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:21.344Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128032.json b/data/2026/128xxx/CVE-2026-128032.json
index bfe2287491..290e9ce1c9 100644
--- a/data/2026/128xxx/CVE-2026-128032.json
+++ b/data/2026/128xxx/CVE-2026-128032.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:33:43.125Z",
"datePublished": "2026-11-13T09:33:59.721Z",
- "dateUpdated": "2026-11-13T09:33:59.721Z"
+ "dateUpdated": "2026-11-13T16:01:33.790Z"
},
"containers": {
"cna": {
@@ -152,6 +152,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:18.635951Z",
+ "id": "CVE-2026-128032",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:33.790Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128034.json b/data/2026/128xxx/CVE-2026-128034.json
new file mode 100644
index 0000000000..fbede5602a
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128034.json
@@ -0,0 +1,114 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-128034",
+ "assignerOrgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "state": "PUBLISHED",
+ "assignerShortName": "Akrites",
+ "dateReserved": "2026-11-12T20:36:23.290Z",
+ "datePublished": "2026-11-13T15:20:35.569Z",
+ "dateUpdated": "2026-11-13T15:20:35.569Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "gittuf: File protection rules bypassed for filenames with special characters",
+ "datePublic": "2026-11-12T19:51:57.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-863",
+ "description": "CWE-863 Incorrect Authorization",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "gittuf",
+ "product": "gittuf",
+ "collectionURL": "https://pkg.go.dev",
+ "packageName": "github.com/gittuf/gittuf",
+ "repo": "https://github.com/gittuf/gittuf",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "0.18.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification."
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-hxqr-h35w-2898"
+ },
+ {
+ "url": "https://github.com/gittuf/gittuf/releases/tag/v0.18.0"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "LOCAL",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "LOW",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to gittuf 0.18.0 or later, which asks Git for raw paths. Then re-run verification (gittuf verify-ref) for each protected reference: a reference that passed verification before the upgrade but fails after it contains a change that should have been blocked."
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Pratham Hegde",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Bhuvan Somisetty",
+ "type": "finder"
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "shortName": "Akrites",
+ "dateUpdated": "2026-11-13T15:20:35.569Z"
+ },
+ "x_generator": {
+ "engine": "cvelib 1.8.0"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128035.json b/data/2026/128xxx/CVE-2026-128035.json
new file mode 100644
index 0000000000..f2bd8f51ca
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128035.json
@@ -0,0 +1,102 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-128035",
+ "assignerOrgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "state": "PUBLISHED",
+ "assignerShortName": "Akrites",
+ "dateReserved": "2026-11-12T20:36:23.291Z",
+ "datePublished": "2026-11-13T15:20:36.628Z",
+ "dateUpdated": "2026-11-13T15:20:36.628Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "gittuf: Propagated controller policies not loaded during verification",
+ "datePublic": "2026-11-12T19:52:16.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-863",
+ "description": "CWE-863 Incorrect Authorization",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "gittuf",
+ "product": "gittuf",
+ "collectionURL": "https://pkg.go.dev",
+ "packageName": "github.com/gittuf/gittuf",
+ "repo": "https://github.com/gittuf/gittuf",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0.10.0",
+ "lessThan": "0.18.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification."
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-pchw-g6rm-gxvh"
+ },
+ {
+ "url": "https://github.com/gittuf/gittuf/releases/tag/v0.18.0"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "LOCAL",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "LOW",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to gittuf 0.18.0 or later, then run gittuf verify-ref over the full history of each protected reference. Policy propagation has been moved back into gittuf's developer mode."
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "shortName": "Akrites",
+ "dateUpdated": "2026-11-13T15:20:36.628Z"
+ },
+ "x_generator": {
+ "engine": "cvelib 1.8.0"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128036.json b/data/2026/128xxx/CVE-2026-128036.json
new file mode 100644
index 0000000000..a8ff26950b
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128036.json
@@ -0,0 +1,102 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-128036",
+ "assignerOrgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "state": "PUBLISHED",
+ "assignerShortName": "Akrites",
+ "dateReserved": "2026-11-12T20:36:23.291Z",
+ "datePublished": "2026-11-13T15:20:37.714Z",
+ "dateUpdated": "2026-11-13T15:20:37.714Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "gittuf: Invalid intermediate policies trusted when the policy apply workflow is bypassed",
+ "datePublic": "2026-10-19T18:16:47.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-863",
+ "description": "CWE-863 Incorrect Authorization",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "gittuf",
+ "product": "gittuf",
+ "collectionURL": "https://pkg.go.dev",
+ "packageName": "github.com/gittuf/gittuf",
+ "repo": "https://github.com/gittuf/gittuf",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0.4.0",
+ "lessThan": "0.17.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "In gittuf 0.4.0 through 0.16.0, when a policy update appears within the range of reference state log entries being verified, verification checks only the root of trust signatures of the new policy and not the signatures of its other metadata (rule files). A user trusted to push to the repository who bypasses gittuf policy apply and writes the policy reference and reference state log directly can make an invalid policy apply during verification, weakening or strengthening the rules for later changes. The update is still recorded in the reference state log."
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-774m-m728-236h"
+ },
+ {
+ "url": "https://github.com/gittuf/gittuf/releases/tag/v0.17.0"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "LOCAL",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "LOW",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "LOW",
+ "baseScore": 2.3,
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to gittuf 0.17.0 or later, then run gittuf verify-ref over the full history of each protected reference. If an intermediate policy is invalid, verification stops with an error; review the reference state log and repository audit logs to find out whether a user with write access tampered with the policy."
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "shortName": "Akrites",
+ "dateUpdated": "2026-11-13T15:20:37.714Z"
+ },
+ "x_generator": {
+ "engine": "cvelib 1.8.0"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128037.json b/data/2026/128xxx/CVE-2026-128037.json
new file mode 100644
index 0000000000..07cafdd25a
--- /dev/null
+++ b/data/2026/128xxx/CVE-2026-128037.json
@@ -0,0 +1,109 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-128037",
+ "assignerOrgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "state": "PUBLISHED",
+ "assignerShortName": "Akrites",
+ "dateReserved": "2026-11-12T20:36:23.291Z",
+ "datePublished": "2026-11-13T15:20:38.824Z",
+ "dateUpdated": "2026-11-13T15:20:38.824Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "gittuf: Policy rules bypassed in the presence of global rules",
+ "datePublic": "2026-09-04T22:19:45.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-863",
+ "description": "CWE-863 Incorrect Authorization",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "gittuf",
+ "product": "gittuf",
+ "collectionURL": "https://pkg.go.dev",
+ "packageName": "github.com/gittuf/gittuf",
+ "repo": "https://github.com/gittuf/gittuf",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0.10.0",
+ "lessThan": "0.16.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's check over all trusted users in the policy precedence over the policy rule's own authorized users. A user listed in the policy file but not authorized by the policy rule, or fewer users than the rule's threshold, can make changes to the protected namespace that pass verification."
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-qc8j-pcph-6q9x"
+ },
+ {
+ "url": "https://github.com/gittuf/gittuf/releases/tag/v0.16.0"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "LOW",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to gittuf 0.16.0 or later, which checks policy rules and global rules independently. Then re-run verification on the repository to make sure the vulnerability was not exploited."
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Arpit Jain",
+ "type": "finder"
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
+ "shortName": "Akrites",
+ "dateUpdated": "2026-11-13T15:20:38.824Z"
+ },
+ "x_generator": {
+ "engine": "cvelib 1.8.0"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128042.json b/data/2026/128xxx/CVE-2026-128042.json
index 2c78038580..46ca5bac37 100644
--- a/data/2026/128xxx/CVE-2026-128042.json
+++ b/data/2026/128xxx/CVE-2026-128042.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:45:47.416Z",
"datePublished": "2026-11-13T09:33:56.952Z",
- "dateUpdated": "2026-11-13T09:33:56.952Z"
+ "dateUpdated": "2026-11-13T16:01:44.930Z"
},
"containers": {
"cna": {
@@ -152,6 +152,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:16.480363Z",
+ "id": "CVE-2026-128042",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:44.930Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128046.json b/data/2026/128xxx/CVE-2026-128046.json
index d2c8e46a31..0a6e7cd37d 100644
--- a/data/2026/128xxx/CVE-2026-128046.json
+++ b/data/2026/128xxx/CVE-2026-128046.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:45:47.416Z",
"datePublished": "2026-11-13T09:33:54.254Z",
- "dateUpdated": "2026-11-13T09:33:54.254Z"
+ "dateUpdated": "2026-11-13T16:01:55.100Z"
},
"containers": {
"cna": {
@@ -176,6 +176,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:34:58.924896Z",
+ "id": "CVE-2026-128046",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:01:55.100Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128051.json b/data/2026/128xxx/CVE-2026-128051.json
index 6ff7857319..4181ef1273 100644
--- a/data/2026/128xxx/CVE-2026-128051.json
+++ b/data/2026/128xxx/CVE-2026-128051.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T20:46:46.662Z",
"datePublished": "2026-11-13T09:33:51.362Z",
- "dateUpdated": "2026-11-13T09:33:51.362Z"
+ "dateUpdated": "2026-11-13T16:02:02.977Z"
},
"containers": {
"cna": {
@@ -164,6 +164,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:14.254132Z",
+ "id": "CVE-2026-128051",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:02.977Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128067.json b/data/2026/128xxx/CVE-2026-128067.json
index 35e55cee53..c6a122c12f 100644
--- a/data/2026/128xxx/CVE-2026-128067.json
+++ b/data/2026/128xxx/CVE-2026-128067.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.129Z",
"datePublished": "2026-11-12T22:49:58.221Z",
- "dateUpdated": "2026-11-12T22:49:58.221Z"
+ "dateUpdated": "2026-11-13T16:03:13.610Z"
},
"containers": {
"cna": {
@@ -103,6 +103,40 @@
"advisory": "GHSA-xcvg-w56q-r89m",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:28:58.565281Z",
+ "id": "CVE-2026-128067",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:03:13.610Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128331.json b/data/2026/128xxx/CVE-2026-128331.json
index 9973cba3a1..60e5a350f4 100644
--- a/data/2026/128xxx/CVE-2026-128331.json
+++ b/data/2026/128xxx/CVE-2026-128331.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T01:20:36.753Z",
"datePublished": "2026-11-13T09:33:42.840Z",
- "dateUpdated": "2026-11-13T09:33:42.840Z"
+ "dateUpdated": "2026-11-13T16:02:13.254Z"
},
"containers": {
"cna": {
@@ -172,6 +172,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:12.069685Z",
+ "id": "CVE-2026-128331",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:13.254Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/128xxx/CVE-2026-128335.json b/data/2026/128xxx/CVE-2026-128335.json
index a4271f1b68..4178df3204 100644
--- a/data/2026/128xxx/CVE-2026-128335.json
+++ b/data/2026/128xxx/CVE-2026-128335.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T01:20:38.188Z",
"datePublished": "2026-11-13T09:33:39.011Z",
- "dateUpdated": "2026-11-13T09:33:39.011Z"
+ "dateUpdated": "2026-11-13T16:02:22.251Z"
},
"containers": {
"cna": {
@@ -210,6 +210,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:09.845342Z",
+ "id": "CVE-2026-128335",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:02:22.251Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129094.json b/data/2026/129xxx/CVE-2026-129094.json
new file mode 100644
index 0000000000..efcbfd2762
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129094.json
@@ -0,0 +1,146 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129094",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:18:30.244Z",
+ "datePublished": "2026-11-13T15:19:40.767Z",
+ "dateUpdated": "2026-11-13T15:19:40.767Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:19:40.767Z"
+ },
+ "datePublic": "2026-10-25T00:00:00.000Z",
+ "title": "@utcp/http before 1.1.14 SSRF to Loopback via Host Placeholder in Call Templates",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a {host} placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE discovery to access internal services on the agent machine."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Server-Side Request Forgery (SSRF)",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "universal-tool-calling-protocol",
+ "product": "@utcp/http",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "status": "affected",
+ "versionType": "semver",
+ "lessThan": "1.1.14"
+ }
+ ],
+ "packageURL": "pkg:npm/%40utcp/http",
+ "collectionURL": "https://www.npmjs.com/package/@utcp/http",
+ "repo": "https://github.com/universal-tool-calling-protocol/typescript-utcp"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "HIGH",
+ "attackRequirements": "PRESENT",
+ "privilegesRequired": "NONE",
+ "userInteraction": "PASSIVE",
+ "vulnConfidentialityImpact": "LOW",
+ "vulnIntegrityImpact": "LOW",
+ "vulnAvailabilityImpact": "NONE",
+ "subConfidentialityImpact": "LOW",
+ "subIntegrityImpact": "LOW",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 2.3,
+ "baseSeverity": "LOW"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "HIGH",
+ "privilegesRequired": "NONE",
+ "userInteraction": "REQUIRED",
+ "scope": "CHANGED",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.7,
+ "baseSeverity": "MEDIUM"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/universal-tool-calling-protocol/typescript-utcp/pull/58",
+ "tags": [
+ "patch",
+ "issue-tracking"
+ ]
+ },
+ {
+ "url": "https://github.com/universal-tool-calling-protocol/typescript-utcp/pull/60",
+ "tags": [
+ "patch",
+ "issue-tracking"
+ ]
+ },
+ {
+ "url": "https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm",
+ "tags": [
+ "related",
+ "vendor-advisory"
+ ],
+ "name": "GitHub Security Advisory (GHSA-r8j5-8747-88cm)"
+ },
+ {
+ "url": "https://www.npmjs.com/package/@utcp/http",
+ "tags": [
+ "product"
+ ]
+ },
+ {
+ "name": "VulnCheck Advisory: @utcp/http before 1.1.14 SSRF to Loopback via Host Placeholder in Call Templates",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/utcp-http-before-1.1.14-ssrf-to-loopback-via-host-placeholder-in-call-templates"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Zachariah Mithani (AploSec)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129099.json b/data/2026/129xxx/CVE-2026-129099.json
new file mode 100644
index 0000000000..3bbb7d2397
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129099.json
@@ -0,0 +1,127 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129099",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:31:00.206Z",
+ "datePublished": "2026-11-13T15:38:32.150Z",
+ "dateUpdated": "2026-11-13T15:38:32.150Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:38:32.150Z"
+ },
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "title": "Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration Import",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Incomplete List of Disallowed Inputs",
+ "cweId": "CWE-184",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+ "product": "TR3000 1.0",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "lessThan": "2.5.42",
+ "status": "affected",
+ "versionType": "semver"
+ },
+ {
+ "version": "2.5.42",
+ "status": "unaffected",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+ "tags": [
+ "release-notes"
+ ],
+ "name": "Cudy TR3000 1.0 Download Center"
+ },
+ {
+ "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+ "tags": [
+ "patch"
+ ],
+ "name": "Cudy TR3000 Firmware 2.5.42"
+ },
+ {
+ "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration Import",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-root-rce-via-openvpn-configuration-import"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129100.json b/data/2026/129xxx/CVE-2026-129100.json
new file mode 100644
index 0000000000..74275790ca
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129100.json
@@ -0,0 +1,127 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129100",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:31:00.206Z",
+ "datePublished": "2026-11-13T15:38:31.536Z",
+ "dateUpdated": "2026-11-13T15:38:31.536Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:38:31.536Z"
+ },
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "title": "Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Key Upload Injection",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with , inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Improper Encoding or Escaping of Output",
+ "cweId": "CWE-116",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+ "product": "TR3000 1.0",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "lessThan": "2.5.42",
+ "status": "affected",
+ "versionType": "semver"
+ },
+ {
+ "version": "2.5.42",
+ "status": "unaffected",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+ "tags": [
+ "release-notes"
+ ],
+ "name": "Cudy TR3000 1.0 Download Center"
+ },
+ {
+ "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+ "tags": [
+ "patch"
+ ],
+ "name": "Cudy TR3000 Firmware 2.5.42"
+ },
+ {
+ "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Key Upload Injection",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-root-rce-via-openvpn-key-upload-injection"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129101.json b/data/2026/129xxx/CVE-2026-129101.json
new file mode 100644
index 0000000000..0109a71f08
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129101.json
@@ -0,0 +1,127 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129101",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:31:00.206Z",
+ "datePublished": "2026-11-13T15:38:30.889Z",
+ "dateUpdated": "2026-11-13T15:38:30.889Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:38:30.889Z"
+ },
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "title": "Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
+ "cweId": "CWE-915",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+ "product": "TR3000 1.0",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "lessThan": "2.5.42",
+ "status": "affected",
+ "versionType": "semver"
+ },
+ {
+ "version": "2.5.42",
+ "status": "unaffected",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+ "tags": [
+ "release-notes"
+ ],
+ "name": "Cudy TR3000 1.0 Download Center"
+ },
+ {
+ "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+ "tags": [
+ "patch"
+ ],
+ "name": "Cudy TR3000 Firmware 2.5.42"
+ },
+ {
+ "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-authenticated-rce-via-vpn-set-conf-mass-assignment"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129102.json b/data/2026/129xxx/CVE-2026-129102.json
new file mode 100644
index 0000000000..b3410bff52
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129102.json
@@ -0,0 +1,127 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129102",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:31:00.206Z",
+ "datePublished": "2026-11-13T15:38:30.213Z",
+ "dateUpdated": "2026-11-13T15:38:30.213Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:38:30.213Z"
+ },
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "title": "Cudy TR3000 before 2.5.42 Command Injection via vpn.set_conf IPsec keyexchange",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')",
+ "cweId": "CWE-93",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+ "product": "TR3000 1.0",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "lessThan": "2.5.42",
+ "status": "affected",
+ "versionType": "semver"
+ },
+ {
+ "version": "2.5.42",
+ "status": "unaffected",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+ "tags": [
+ "release-notes"
+ ],
+ "name": "Cudy TR3000 1.0 Download Center"
+ },
+ {
+ "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+ "tags": [
+ "patch"
+ ],
+ "name": "Cudy TR3000 Firmware 2.5.42"
+ },
+ {
+ "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via vpn.set_conf IPsec keyexchange",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-set-conf-ipsec-keyexchange"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129103.json b/data/2026/129xxx/CVE-2026-129103.json
new file mode 100644
index 0000000000..02b2ada863
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129103.json
@@ -0,0 +1,127 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129103",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:31:00.206Z",
+ "datePublished": "2026-11-13T15:38:29.548Z",
+ "dateUpdated": "2026-11-13T15:38:29.548Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:38:29.548Z"
+ },
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "title": "Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')",
+ "cweId": "CWE-93",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+ "product": "TR3000 1.0",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "lessThan": "2.5.42",
+ "status": "affected",
+ "versionType": "semver"
+ },
+ {
+ "version": "2.5.42",
+ "status": "unaffected",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+ "tags": [
+ "release-notes"
+ ],
+ "name": "Cudy TR3000 1.0 Download Center"
+ },
+ {
+ "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+ "tags": [
+ "patch"
+ ],
+ "name": "Cudy TR3000 Firmware 2.5.42"
+ },
+ {
+ "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-scheduled-reboot-time"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129104.json b/data/2026/129xxx/CVE-2026-129104.json
new file mode 100644
index 0000000000..0b702a6f9b
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129104.json
@@ -0,0 +1,127 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129104",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:31:00.207Z",
+ "datePublished": "2026-11-13T15:38:28.886Z",
+ "dateUpdated": "2026-11-13T15:38:28.886Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:38:28.886Z"
+ },
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "title": "Cudy TR3000 before 2.5.42 dnsmasq Configuration Injection via net.set_dhcp",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')",
+ "cweId": "CWE-93",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+ "product": "TR3000 1.0",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "lessThan": "2.5.42",
+ "status": "affected",
+ "versionType": "semver"
+ },
+ {
+ "version": "2.5.42",
+ "status": "unaffected",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 7,
+ "baseSeverity": "HIGH"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+ "tags": [
+ "release-notes"
+ ],
+ "name": "Cudy TR3000 1.0 Download Center"
+ },
+ {
+ "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+ "tags": [
+ "patch"
+ ],
+ "name": "Cudy TR3000 Firmware 2.5.42"
+ },
+ {
+ "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 dnsmasq Configuration Injection via net.set_dhcp",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-dnsmasq-configuration-injection-via-net-set-dhcp"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129105.json b/data/2026/129xxx/CVE-2026-129105.json
new file mode 100644
index 0000000000..ee914f2828
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129105.json
@@ -0,0 +1,127 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129105",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:31:00.207Z",
+ "datePublished": "2026-11-13T15:38:28.271Z",
+ "dateUpdated": "2026-11-13T15:38:28.271Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:38:28.271Z"
+ },
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "title": "Cudy TR3000 before 2.5.42 pppd Option Injection via net.set_wan L2TP Credentials",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process."
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')",
+ "cweId": "CWE-93",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Shenzhen Cudy Technology Co., Ltd.",
+ "product": "TR3000 1.0",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "0",
+ "lessThan": "2.5.42",
+ "status": "affected",
+ "versionType": "semver"
+ },
+ {
+ "version": "2.5.42",
+ "status": "unaffected",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 7,
+ "baseSeverity": "HIGH"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0",
+ "tags": [
+ "release-notes"
+ ],
+ "name": "Cudy TR3000 1.0 Download Center"
+ },
+ {
+ "url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip",
+ "tags": [
+ "patch"
+ ],
+ "name": "Cudy TR3000 Firmware 2.5.42"
+ },
+ {
+ "name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 pppd Option Injection via net.set_wan L2TP Credentials",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-pppd-option-injection-via-net-set-wan-l2tp-credentials"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/129xxx/CVE-2026-129110.json b/data/2026/129xxx/CVE-2026-129110.json
new file mode 100644
index 0000000000..8fcbe59448
--- /dev/null
+++ b/data/2026/129xxx/CVE-2026-129110.json
@@ -0,0 +1,168 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-129110",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-11-13T15:45:08.263Z",
+ "datePublished": "2026-11-13T15:46:29.636Z",
+ "dateUpdated": "2026-11-13T15:46:29.636Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:46:29.636Z"
+ },
+ "datePublic": "2026-07-03T00:00:00.000Z",
+ "title": "sysPass 3.0.1 through 3.2.11 Unauthenticated Reinstallation RCE via install/install",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands."
+ }
+ ],
+ "tags": [
+ "unsupported-when-assigned"
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Missing Authentication for Critical Function",
+ "cweId": "CWE-306",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "nuxsmin",
+ "product": "sysPass",
+ "defaultStatus": "unaffected",
+ "versions": [
+ {
+ "version": "3.0.1",
+ "status": "affected",
+ "versionType": "semver",
+ "lessThanOrEqual": "3.2.11"
+ }
+ ],
+ "packageURL": "pkg:github/nuxsmin/syspass",
+ "repo": "https://github.com/nuxsmin/sysPass"
+ }
+ ],
+ "cpeApplicability": [
+ {
+ "nodes": [
+ {
+ "operator": "OR",
+ "negate": false,
+ "cpeMatch": [
+ {
+ "vulnerable": true,
+ "criteria": "cpe:2.3:a:cygnux:syspass:*:*:*:*:*:*:*:*",
+ "versionStartIncluding": "3.0.1",
+ "versionEndIncluding": "3.2.11"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "cvssV4_0": {
+ "version": "4.0",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 9.3,
+ "baseSeverity": "CRITICAL"
+ }
+ },
+ {
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseScore": 9.8,
+ "baseSeverity": "CRITICAL"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/nuxsmin/sysPass/blob/3.2.11/app/modules/web/Controllers/InstallController.php#L80-L110",
+ "tags": [
+ "technical-description"
+ ]
+ },
+ {
+ "url": "https://github.com/OpusProjects/sysPass/pull/360",
+ "tags": [
+ "patch",
+ "issue-tracking"
+ ]
+ },
+ {
+ "url": "https://github.com/nuxsmin/sysPass/issues/1954",
+ "tags": [
+ "issue-tracking"
+ ]
+ },
+ {
+ "url": "https://github.com/nuxsmin/sysPass",
+ "tags": [
+ "product"
+ ]
+ },
+ {
+ "name": "VulnCheck Advisory: sysPass 3.0.1 through 3.2.11 Unauthenticated Reinstallation RCE via install/install",
+ "tags": [
+ "third-party-advisory"
+ ],
+ "url": "https://www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "r3verii (Martino Spagnuolo)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Marcos Azevedo (psylinux)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck-endgame"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/14xxx/CVE-2026-14447.json b/data/2026/14xxx/CVE-2026-14447.json
index 625cb15edd..61c08572f3 100644
--- a/data/2026/14xxx/CVE-2026-14447.json
+++ b/data/2026/14xxx/CVE-2026-14447.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:45:18.712Z",
"datePublished": "2026-11-10T19:20:15.571Z",
- "dateUpdated": "2026-11-10T19:20:15.571Z"
+ "dateUpdated": "2026-11-13T15:25:40.299Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 2.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:25:30.426205Z",
+ "id": "CVE-2026-14447",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:25:40.299Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/49xxx/CVE-2026-49341.json b/data/2026/49xxx/CVE-2026-49341.json
new file mode 100644
index 0000000000..9ca65c4eb0
--- /dev/null
+++ b/data/2026/49xxx/CVE-2026-49341.json
@@ -0,0 +1,101 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-49341",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-05-29T14:35:45.902Z",
+ "datePublished": "2026-11-13T15:53:53.720Z",
+ "dateUpdated": "2026-11-13T15:53:53.720Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-400",
+ "lang": "en",
+ "description": "CWE-400: Uncontrolled Resource Consumption",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-674",
+ "lang": "en",
+ "description": "CWE-674: Uncontrolled Recursion",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7r8r-2rj2-5wvr",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7r8r-2rj2-5wvr"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1347",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1347"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:53:53.720Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, there is a remotely reachable denial-of-service vulnerability in bacnet-stack affecting the default demo server built from the unmodified apps/server/main.c. This issue has been patched in version 1.5.1."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-7r8r-2rj2-5wvr",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/49xxx/CVE-2026-49990.json b/data/2026/49xxx/CVE-2026-49990.json
new file mode 100644
index 0000000000..353b9ad16a
--- /dev/null
+++ b/data/2026/49xxx/CVE-2026-49990.json
@@ -0,0 +1,105 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-49990",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-06-02T18:30:51.282Z",
+ "datePublished": "2026-11-13T15:54:22.681Z",
+ "dateUpdated": "2026-11-13T15:54:22.681Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-125",
+ "lang": "en",
+ "description": "CWE-125: Out-of-bounds Read",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-787",
+ "lang": "en",
+ "description": "CWE-787: Out-of-bounds Write",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1362",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1362"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": ">= 1.4.2, < 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": ">= 1.5.0, < 1.5.1",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:54:22.681Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-8759-hx7g-94qx",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/52xxx/CVE-2026-52787.json b/data/2026/52xxx/CVE-2026-52787.json
new file mode 100644
index 0000000000..1266c9ebb9
--- /dev/null
+++ b/data/2026/52xxx/CVE-2026-52787.json
@@ -0,0 +1,109 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-52787",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-06-08T18:02:19.730Z",
+ "datePublished": "2026-11-13T15:54:51.243Z",
+ "dateUpdated": "2026-11-13T15:54:51.243Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-131",
+ "lang": "en",
+ "description": "CWE-131: Incorrect Calculation of Buffer Size",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-787",
+ "lang": "en",
+ "description": "CWE-787: Out-of-bounds Write",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1363",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1363"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0-rc2",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:54:51.243Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-4fgg-fghm-jm43",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/52xxx/CVE-2026-52788.json b/data/2026/52xxx/CVE-2026-52788.json
new file mode 100644
index 0000000000..8d09c7e956
--- /dev/null
+++ b/data/2026/52xxx/CVE-2026-52788.json
@@ -0,0 +1,102 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-52788",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-06-08T18:02:19.731Z",
+ "datePublished": "2026-11-13T15:56:05.655Z",
+ "dateUpdated": "2026-11-13T15:56:05.655Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-787",
+ "lang": "en",
+ "description": "CWE-787: Out-of-bounds Write",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "LOW",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
+ "version": "4.0"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rf83-3rr5-v4mj",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rf83-3rr5-v4mj"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1365",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1365"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:56:05.655Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the bsc_node_parse_urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three distinct bugs when parsing space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Two bugs cause out-of-bounds writes past the utf8_urls[10][129] array in the static BSC_ADDRESS_RESOLUTION structure. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-rf83-3rr5-v4mj",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/52xxx/CVE-2026-52789.json b/data/2026/52xxx/CVE-2026-52789.json
new file mode 100644
index 0000000000..c1ef8ccefc
--- /dev/null
+++ b/data/2026/52xxx/CVE-2026-52789.json
@@ -0,0 +1,99 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-52789",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-06-08T18:02:19.731Z",
+ "datePublished": "2026-11-13T15:56:44.502Z",
+ "dateUpdated": "2026-11-13T15:56:44.502Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-835",
+ "lang": "en",
+ "description": "CWE-835: Loop with Unreachable Exit Condition",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4rf9-4vgq-5gcw",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4rf9-4vgq-5gcw"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1374",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1374"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:56:44.502Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-4rf9-4vgq-5gcw",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/52xxx/CVE-2026-52790.json b/data/2026/52xxx/CVE-2026-52790.json
new file mode 100644
index 0000000000..2f6532caa6
--- /dev/null
+++ b/data/2026/52xxx/CVE-2026-52790.json
@@ -0,0 +1,109 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-52790",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-06-08T18:02:19.731Z",
+ "datePublished": "2026-11-13T15:57:10.497Z",
+ "dateUpdated": "2026-11-13T15:57:10.497Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-416",
+ "lang": "en",
+ "description": "CWE-416: Use After Free",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-562",
+ "lang": "en",
+ "description": "CWE-562: Return of Stack Variable Address",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1375",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1375"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:57:10.497Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-jr7p-rm2x-739x",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/55xxx/CVE-2026-55316.json b/data/2026/55xxx/CVE-2026-55316.json
index 4c6a30f71e..2e46298252 100644
--- a/data/2026/55xxx/CVE-2026-55316.json
+++ b/data/2026/55xxx/CVE-2026-55316.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-16T17:48:40.352Z",
"datePublished": "2026-11-10T19:20:20.351Z",
- "dateUpdated": "2026-11-10T19:20:20.351Z"
+ "dateUpdated": "2026-11-13T15:27:11.341Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 6.8,
+ "attackVector": "PHYSICAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+ "integrityImpact": "HIGH",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "HIGH"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:27:07.453572Z",
+ "id": "CVE-2026-55316",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:27:11.341Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/55xxx/CVE-2026-55335.json b/data/2026/55xxx/CVE-2026-55335.json
index 3b92569e50..5379188357 100644
--- a/data/2026/55xxx/CVE-2026-55335.json
+++ b/data/2026/55xxx/CVE-2026-55335.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-16T17:51:15.420Z",
"datePublished": "2026-11-10T19:20:23.232Z",
- "dateUpdated": "2026-11-10T19:20:23.232Z"
+ "dateUpdated": "2026-11-13T15:44:51.499Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-416",
+ "lang": "en",
+ "description": "CWE-416 Use After Free"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 9.8,
+ "attackVector": "NETWORK",
+ "baseSeverity": "CRITICAL",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+ "integrityImpact": "HIGH",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "HIGH"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:44:48.151839Z",
+ "id": "CVE-2026-55335",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:44:51.499Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/55xxx/CVE-2026-55348.json b/data/2026/55xxx/CVE-2026-55348.json
index 03d44bb1f2..de470fbc3b 100644
--- a/data/2026/55xxx/CVE-2026-55348.json
+++ b/data/2026/55xxx/CVE-2026-55348.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-16T17:54:14.670Z",
"datePublished": "2026-11-10T19:20:26.097Z",
- "dateUpdated": "2026-11-10T19:20:26.097Z"
+ "dateUpdated": "2026-11-13T15:29:25.978Z"
},
"containers": {
"cna": {
@@ -54,6 +54,74 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-704",
+ "lang": "en",
+ "description": "CWE-704 Incorrect Type Conversion or Cast"
+ },
+ {
+ "type": "CWE",
+ "cweId": "CWE-125",
+ "lang": "en",
+ "description": "CWE-125 Out-of-bounds Read"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 2.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:28:53.773587Z",
+ "id": "CVE-2026-55348",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:29:25.978Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/56xxx/CVE-2026-56897.json b/data/2026/56xxx/CVE-2026-56897.json
index 25a0013460..72671237c7 100644
--- a/data/2026/56xxx/CVE-2026-56897.json
+++ b/data/2026/56xxx/CVE-2026-56897.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-23T16:05:58.747Z",
"datePublished": "2026-11-10T19:20:29.960Z",
- "dateUpdated": "2026-11-10T19:20:29.960Z"
+ "dateUpdated": "2026-11-13T15:30:15.098Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-908",
+ "lang": "en",
+ "description": "CWE-908 Use of Uninitialized Resource"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 4,
+ "attackVector": "LOCAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:29:49.230096Z",
+ "id": "CVE-2026-56897",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:30:15.098Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/56xxx/CVE-2026-56902.json b/data/2026/56xxx/CVE-2026-56902.json
index 069ade34e4..66541f261d 100644
--- a/data/2026/56xxx/CVE-2026-56902.json
+++ b/data/2026/56xxx/CVE-2026-56902.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-23T16:07:18.917Z",
"datePublished": "2026-11-10T19:20:32.156Z",
- "dateUpdated": "2026-11-10T19:20:32.156Z"
+ "dateUpdated": "2026-11-13T15:40:24.918Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 4,
+ "attackVector": "LOCAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:40:20.479330Z",
+ "id": "CVE-2026-56902",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:40:24.918Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/56xxx/CVE-2026-56935.json b/data/2026/56xxx/CVE-2026-56935.json
index b8177f58c6..c090e2e2c8 100644
--- a/data/2026/56xxx/CVE-2026-56935.json
+++ b/data/2026/56xxx/CVE-2026-56935.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-23T16:12:13.079Z",
"datePublished": "2026-11-10T19:20:45.883Z",
- "dateUpdated": "2026-11-10T19:20:45.883Z"
+ "dateUpdated": "2026-11-13T15:40:57.074Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 4,
+ "attackVector": "LOCAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:40:53.635934Z",
+ "id": "CVE-2026-56935",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:40:57.074Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/56xxx/CVE-2026-56943.json b/data/2026/56xxx/CVE-2026-56943.json
index db1d41e033..a68fcb4f3a 100644
--- a/data/2026/56xxx/CVE-2026-56943.json
+++ b/data/2026/56xxx/CVE-2026-56943.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-23T16:13:58.908Z",
"datePublished": "2026-11-10T19:20:48.440Z",
- "dateUpdated": "2026-11-10T19:20:48.440Z"
+ "dateUpdated": "2026-11-13T15:41:45.271Z"
},
"containers": {
"cna": {
@@ -54,6 +54,74 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-125",
+ "lang": "en",
+ "description": "CWE-125 Out-of-bounds Read"
+ },
+ {
+ "type": "CWE",
+ "cweId": "CWE-119",
+ "lang": "en",
+ "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 2.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:41:41.522744Z",
+ "id": "CVE-2026-56943",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:41:45.271Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/56xxx/CVE-2026-56947.json b/data/2026/56xxx/CVE-2026-56947.json
index 9177097c9f..28adb26876 100644
--- a/data/2026/56xxx/CVE-2026-56947.json
+++ b/data/2026/56xxx/CVE-2026-56947.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-23T16:13:58.908Z",
"datePublished": "2026-11-10T19:20:51.846Z",
- "dateUpdated": "2026-11-10T19:20:51.846Z"
+ "dateUpdated": "2026-11-13T15:42:19.298Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-441",
+ "lang": "en",
+ "description": "CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 4,
+ "attackVector": "LOCAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:42:15.530544Z",
+ "id": "CVE-2026-56947",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:42:19.298Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/56xxx/CVE-2026-56956.json b/data/2026/56xxx/CVE-2026-56956.json
index e927304f8b..7b18938865 100644
--- a/data/2026/56xxx/CVE-2026-56956.json
+++ b/data/2026/56xxx/CVE-2026-56956.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-06-23T16:15:23.846Z",
"datePublished": "2026-11-10T19:20:54.733Z",
- "dateUpdated": "2026-11-10T19:20:54.733Z"
+ "dateUpdated": "2026-11-13T15:42:59.759Z"
},
"containers": {
"cna": {
@@ -54,6 +54,74 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ },
+ {
+ "type": "CWE",
+ "cweId": "CWE-122",
+ "lang": "en",
+ "description": "CWE-122 Heap-based Buffer Overflow"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 5.3,
+ "attackVector": "NETWORK",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:42:34.536785Z",
+ "id": "CVE-2026-56956",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "yes"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:42:59.759Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58265.json b/data/2026/58xxx/CVE-2026-58265.json
new file mode 100644
index 0000000000..533260341b
--- /dev/null
+++ b/data/2026/58xxx/CVE-2026-58265.json
@@ -0,0 +1,99 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-58265",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-06-29T21:54:30.331Z",
+ "datePublished": "2026-11-13T15:58:11.001Z",
+ "dateUpdated": "2026-11-13T15:58:11.001Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-125",
+ "lang": "en",
+ "description": "CWE-125: Out-of-bounds Read",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1396",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1396"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:58:11.001Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-j66x-fr38-r7m5",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58498.json b/data/2026/58xxx/CVE-2026-58498.json
new file mode 100644
index 0000000000..16c152f72e
--- /dev/null
+++ b/data/2026/58xxx/CVE-2026-58498.json
@@ -0,0 +1,99 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-58498",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-06-30T20:21:25.813Z",
+ "datePublished": "2026-11-13T15:57:47.797Z",
+ "dateUpdated": "2026-11-13T15:57:47.797Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-787",
+ "lang": "en",
+ "description": "CWE-787: Out-of-bounds Write",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1392",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1392"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:57:47.797Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-of-bounds write to the global transmit buffer under ASan. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-4p4w-m434-jrhj",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58702.json b/data/2026/58xxx/CVE-2026-58702.json
index aa0ee6e4b3..909867f7ac 100644
--- a/data/2026/58xxx/CVE-2026-58702.json
+++ b/data/2026/58xxx/CVE-2026-58702.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:37:09.598Z",
"datePublished": "2026-11-10T19:21:16.816Z",
- "dateUpdated": "2026-11-10T19:21:16.816Z"
+ "dateUpdated": "2026-11-13T15:43:34.827Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-441",
+ "lang": "en",
+ "description": "CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 4,
+ "attackVector": "LOCAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:43:31.558368Z",
+ "id": "CVE-2026-58702",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:43:34.827Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58762.json b/data/2026/58xxx/CVE-2026-58762.json
index e128a7c6c4..b79a4273e5 100644
--- a/data/2026/58xxx/CVE-2026-58762.json
+++ b/data/2026/58xxx/CVE-2026-58762.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:45:35.351Z",
"datePublished": "2026-11-10T19:21:25.657Z",
- "dateUpdated": "2026-11-10T19:21:25.657Z"
+ "dateUpdated": "2026-11-13T15:23:24.328Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-20",
+ "lang": "en",
+ "description": "CWE-20 Improper Input Validation"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 2.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:23:20.813262Z",
+ "id": "CVE-2026-58762",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:23:24.328Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58769.json b/data/2026/58xxx/CVE-2026-58769.json
index 51fbdce765..99c0e8b3d5 100644
--- a/data/2026/58xxx/CVE-2026-58769.json
+++ b/data/2026/58xxx/CVE-2026-58769.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:46:59.932Z",
"datePublished": "2026-11-10T19:21:26.626Z",
- "dateUpdated": "2026-11-10T19:21:26.626Z"
+ "dateUpdated": "2026-11-13T15:22:54.063Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-119",
+ "lang": "en",
+ "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 2.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:22:51.035260Z",
+ "id": "CVE-2026-58769",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:22:54.063Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58782.json b/data/2026/58xxx/CVE-2026-58782.json
index 42d71c20a1..ca1cb9292a 100644
--- a/data/2026/58xxx/CVE-2026-58782.json
+++ b/data/2026/58xxx/CVE-2026-58782.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:48:47.082Z",
"datePublished": "2026-11-10T19:21:31.440Z",
- "dateUpdated": "2026-11-10T19:21:31.440Z"
+ "dateUpdated": "2026-11-13T15:44:16.544Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 6.2,
+ "attackVector": "LOCAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "NONE"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:44:13.129854Z",
+ "id": "CVE-2026-58782",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:44:16.544Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58783.json b/data/2026/58xxx/CVE-2026-58783.json
index 8ff955940d..67a95bc2e0 100644
--- a/data/2026/58xxx/CVE-2026-58783.json
+++ b/data/2026/58xxx/CVE-2026-58783.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:48:47.082Z",
"datePublished": "2026-11-10T19:21:32.394Z",
- "dateUpdated": "2026-11-10T19:21:32.394Z"
+ "dateUpdated": "2026-11-13T15:22:24.678Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 4.4,
+ "attackVector": "LOCAL",
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "HIGH",
+ "privilegesRequired": "HIGH",
+ "confidentialityImpact": "NONE"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:22:21.468411Z",
+ "id": "CVE-2026-58783",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:22:24.678Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58797.json b/data/2026/58xxx/CVE-2026-58797.json
index 31565fd0a7..840490a5e1 100644
--- a/data/2026/58xxx/CVE-2026-58797.json
+++ b/data/2026/58xxx/CVE-2026-58797.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:51:13.097Z",
"datePublished": "2026-11-10T19:21:41.032Z",
- "dateUpdated": "2026-11-10T19:21:41.032Z"
+ "dateUpdated": "2026-11-13T15:21:55.122Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 3.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:21:50.237941Z",
+ "id": "CVE-2026-58797",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:21:55.122Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58801.json b/data/2026/58xxx/CVE-2026-58801.json
index 59cb0bc55a..b7cd72c94c 100644
--- a/data/2026/58xxx/CVE-2026-58801.json
+++ b/data/2026/58xxx/CVE-2026-58801.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:51:13.097Z",
"datePublished": "2026-11-10T19:21:44.890Z",
- "dateUpdated": "2026-11-10T19:21:44.890Z"
+ "dateUpdated": "2026-11-13T15:21:01.665Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-672",
+ "lang": "en",
+ "description": "CWE-672 Operation on a Resource after Expiration or Release"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 2.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:20:58.908614Z",
+ "id": "CVE-2026-58801",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:21:01.665Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58803.json b/data/2026/58xxx/CVE-2026-58803.json
index 9679c7fe0b..5b2f59d211 100644
--- a/data/2026/58xxx/CVE-2026-58803.json
+++ b/data/2026/58xxx/CVE-2026-58803.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:51:13.097Z",
"datePublished": "2026-11-10T19:21:45.849Z",
- "dateUpdated": "2026-11-10T19:21:45.849Z"
+ "dateUpdated": "2026-11-13T15:20:20.940Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-203",
+ "lang": "en",
+ "description": "CWE-203 Observable Discrepancy"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 2.9,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "HIGH",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:20:17.619025Z",
+ "id": "CVE-2026-58803",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:20:20.940Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/58xxx/CVE-2026-58806.json b/data/2026/58xxx/CVE-2026-58806.json
index 84fa1ac280..709dd1c027 100644
--- a/data/2026/58xxx/CVE-2026-58806.json
+++ b/data/2026/58xxx/CVE-2026-58806.json
@@ -8,7 +8,7 @@
"assignerShortName": "Google_Devices",
"dateReserved": "2026-07-02T05:52:23.114Z",
"datePublished": "2026-11-10T19:21:48.719Z",
- "dateUpdated": "2026-11-10T19:21:48.719Z"
+ "dateUpdated": "2026-11-13T15:19:26.770Z"
},
"containers": {
"cna": {
@@ -54,6 +54,68 @@
"x_generator": {
"engine": "cvelib 1.7.1"
}
- }
+ },
+ "adp": [
+ {
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "type": "CWE",
+ "cweId": "CWE-693",
+ "lang": "en",
+ "description": "CWE-693 Protection Mechanism Failure"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "scope": "UNCHANGED",
+ "version": "3.1",
+ "baseScore": 3.3,
+ "attackVector": "LOCAL",
+ "baseSeverity": "LOW",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "integrityImpact": "NONE",
+ "userInteraction": "NONE",
+ "attackComplexity": "LOW",
+ "availabilityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "confidentialityImpact": "LOW"
+ }
+ },
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:19:22.552996Z",
+ "id": "CVE-2026-58806",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:19:26.770Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/62xxx/CVE-2026-62972.json b/data/2026/62xxx/CVE-2026-62972.json
new file mode 100644
index 0000000000..9a88e9f534
--- /dev/null
+++ b/data/2026/62xxx/CVE-2026-62972.json
@@ -0,0 +1,102 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-62972",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-07-14T22:48:09.780Z",
+ "datePublished": "2026-11-13T15:58:33.986Z",
+ "dateUpdated": "2026-11-13T15:58:33.986Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-125",
+ "lang": "en",
+ "description": "CWE-125: Out-of-bounds Read",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "LOW",
+ "vulnIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "LOW",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 6.9,
+ "baseSeverity": "MEDIUM",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
+ "version": "4.0"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1412",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1412"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:58:33.986Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-9hq3-w3pc-8385",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/62xxx/CVE-2026-62973.json b/data/2026/62xxx/CVE-2026-62973.json
new file mode 100644
index 0000000000..368abf7b9f
--- /dev/null
+++ b/data/2026/62xxx/CVE-2026-62973.json
@@ -0,0 +1,99 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-62973",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-07-14T22:48:09.780Z",
+ "datePublished": "2026-11-13T15:59:09.431Z",
+ "dateUpdated": "2026-11-13T15:59:09.431Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-125",
+ "lang": "en",
+ "description": "CWE-125: Out-of-bounds Read",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV3_1": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1395",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1395"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T15:59:09.431Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-3xxw-jfwm-rq9c",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/62xxx/CVE-2026-62974.json b/data/2026/62xxx/CVE-2026-62974.json
new file mode 100644
index 0000000000..2a8ae576af
--- /dev/null
+++ b/data/2026/62xxx/CVE-2026-62974.json
@@ -0,0 +1,102 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-62974",
+ "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "state": "PUBLISHED",
+ "assignerShortName": "GitHub_M",
+ "dateReserved": "2026-07-14T22:48:09.780Z",
+ "datePublished": "2026-11-13T16:00:10.321Z",
+ "dateUpdated": "2026-11-13T16:00:10.321Z"
+ },
+ "containers": {
+ "cna": {
+ "title": "BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-835",
+ "lang": "en",
+ "description": "CWE-835: Loop with Unreachable Exit Condition",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "subAvailabilityImpact": "NONE",
+ "baseScore": 8.7,
+ "baseSeverity": "HIGH",
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+ "version": "4.0"
+ }
+ }
+ ],
+ "references": [
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2c8x-f46r-8phh",
+ "tags": [
+ "x_refsource_CONFIRM"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2c8x-f46r-8phh"
+ },
+ {
+ "name": "https://github.com/bacnet-stack/bacnet-stack/pull/1410",
+ "tags": [
+ "x_refsource_MISC"
+ ],
+ "url": "https://github.com/bacnet-stack/bacnet-stack/pull/1410"
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "bacnet-stack",
+ "product": "bacnet-stack",
+ "versions": [
+ {
+ "version": "< 1.4.5",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.5.1",
+ "status": "affected"
+ },
+ {
+ "version": "< 1.6.0",
+ "status": "affected"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
+ "shortName": "GitHub_M",
+ "dateUpdated": "2026-11-13T16:00:10.321Z"
+ },
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
+ }
+ ],
+ "source": {
+ "advisory": "GHSA-2c8x-f46r-8phh",
+ "discovery": "UNKNOWN"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/63xxx/CVE-2026-63010.json b/data/2026/63xxx/CVE-2026-63010.json
index 127b080abf..3decae955b 100644
--- a/data/2026/63xxx/CVE-2026-63010.json
+++ b/data/2026/63xxx/CVE-2026-63010.json
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-07-14T23:10:57.033Z",
"datePublished": "2026-11-10T16:35:20.103Z",
- "dateUpdated": "2026-11-10T16:35:20.103Z"
+ "dateUpdated": "2026-11-13T15:24:27.290Z"
},
"containers": {
"cna": {
@@ -121,6 +121,40 @@
"advisory": "GHSA-jw34-6g49-r6cw",
"discovery": "UNKNOWN"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:23:43.663019Z",
+ "id": "CVE-2026-63010",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:24:27.290Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/63xxx/CVE-2026-63079.json b/data/2026/63xxx/CVE-2026-63079.json
new file mode 100644
index 0000000000..bb61597e96
--- /dev/null
+++ b/data/2026/63xxx/CVE-2026-63079.json
@@ -0,0 +1,148 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-63079",
+ "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "state": "PUBLISHED",
+ "assignerShortName": "VulnCheck",
+ "dateReserved": "2026-07-15T15:45:44.599Z",
+ "datePublished": "2026-11-13T15:19:20.082Z",
+ "dateUpdated": "2026-11-13T15:20:01.028Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
+ "shortName": "VulnCheck",
+ "dateUpdated": "2026-11-13T15:20:01.028Z"
+ },
+ "title": "RBH Integra32 5.1.11 .NET Remoting Deserialization RCE",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\\SYSTEM and fully compromise the host."
+ }
+ ],
+ "datePublic": "2026-11-13T00:00:00.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "description": "Deserialization of Untrusted Data",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "defaultStatus": "unknown",
+ "vendor": "RBH Access Technologies",
+ "product": "Integra32 Security Management System",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "5.1.11 R5.0",
+ "versionType": "custom"
+ }
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "HIGH",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "HIGH",
+ "subAvailabilityImpact": "NONE",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "CRITICAL",
+ "baseScore": 9.3,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+ }
+ },
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "version": "3.1",
+ "baseSeverity": "CRITICAL",
+ "baseScore": 9.8,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ }
+ ],
+ "references": [
+ {
+ "url": "https://gist.github.com/VAMorales/b981c0062a9a7e8942439f97246669b6",
+ "name": "Researcher Disclosure",
+ "tags": [
+ "technical-description",
+ "exploit"
+ ]
+ },
+ {
+ "url": "https://rbh-access.com/software/integra32/",
+ "name": "Product Page",
+ "tags": [
+ "product"
+ ]
+ },
+ {
+ "url": "https://www.vulncheck.com/advisories/rbh-integra32-net-remoting-deserialization-rce",
+ "name": "VulnCheck Advisory: RBH Integra32 5.1.11 .NET Remoting Deserialization RCE",
+ "tags": [
+ "third-party-advisory"
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp.",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "vulncheck"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75489.json b/data/2026/75xxx/CVE-2026-75489.json
index 4156becd66..05ef5a964b 100644
--- a/data/2026/75xxx/CVE-2026-75489.json
+++ b/data/2026/75xxx/CVE-2026-75489.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-08-17T20:07:25.283Z",
"datePublished": "2026-11-13T09:36:57.850Z",
- "dateUpdated": "2026-11-13T09:36:57.850Z"
+ "dateUpdated": "2026-11-13T15:52:55.071Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:52.701235Z",
+ "id": "CVE-2026-75489",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:52:55.071Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75493.json b/data/2026/75xxx/CVE-2026-75493.json
index b0ec8939ac..8bbdfed0a9 100644
--- a/data/2026/75xxx/CVE-2026-75493.json
+++ b/data/2026/75xxx/CVE-2026-75493.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-08-17T20:07:25.283Z",
"datePublished": "2026-11-13T09:36:55.144Z",
- "dateUpdated": "2026-11-13T09:36:55.144Z"
+ "dateUpdated": "2026-11-13T15:53:01.138Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:30:50.212575Z",
+ "id": "CVE-2026-75493",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:01.138Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/75xxx/CVE-2026-75577.json b/data/2026/75xxx/CVE-2026-75577.json
index 41358385c9..f477d91f37 100644
--- a/data/2026/75xxx/CVE-2026-75577.json
+++ b/data/2026/75xxx/CVE-2026-75577.json
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-08-17T22:02:43.612Z",
"datePublished": "2026-11-13T09:36:52.428Z",
- "dateUpdated": "2026-11-13T09:36:52.428Z"
+ "dateUpdated": "2026-11-13T15:53:09.724Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:39.732052Z",
+ "id": "CVE-2026-75577",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:53:09.724Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/82xxx/CVE-2026-82174.json b/data/2026/82xxx/CVE-2026-82174.json
new file mode 100644
index 0000000000..0fe34038d7
--- /dev/null
+++ b/data/2026/82xxx/CVE-2026-82174.json
@@ -0,0 +1,284 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-82174",
+ "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+ "state": "PUBLISHED",
+ "assignerShortName": "dell",
+ "dateReserved": "2026-08-28T07:04:31.457Z",
+ "datePublished": "2026-11-13T15:23:45.724Z",
+ "dateUpdated": "2026-11-13T15:23:45.724Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
+ "shortName": "dell",
+ "dateUpdated": "2026-11-13T15:23:45.724Z"
+ },
+ "datePublic": "2026-10-30T06:30:00.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-451",
+ "description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 500T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 1000T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 1200T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 3000T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 3200Q",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 3200T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 5000T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 5200Q",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 5200T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 7000T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 9000T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 9200T",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 1500",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 5500",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Dell",
+ "product": "PowerStore 9500",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "5.1.0.0-2798105 or later",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "REQUIRED",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "LOW",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ }
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "x_generator": {
+ "engine": "Vulnogram 1.0.5"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/82xxx/CVE-2026-82175.json b/data/2026/82xxx/CVE-2026-82175.json
index 382c1c4017..a9124fdbc9 100644
--- a/data/2026/82xxx/CVE-2026-82175.json
+++ b/data/2026/82xxx/CVE-2026-82175.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-08-28T07:04:31.457Z",
"datePublished": "2026-11-13T15:08:17.835Z",
- "dateUpdated": "2026-11-13T15:08:17.835Z"
+ "dateUpdated": "2026-11-13T16:11:35.270Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:00:55.638874Z",
+ "id": "CVE-2026-82175",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:11:35.270Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/82xxx/CVE-2026-82177.json b/data/2026/82xxx/CVE-2026-82177.json
index d2d6ae2c7d..162870801b 100644
--- a/data/2026/82xxx/CVE-2026-82177.json
+++ b/data/2026/82xxx/CVE-2026-82177.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-08-28T07:04:31.457Z",
"datePublished": "2026-11-13T14:13:13.256Z",
- "dateUpdated": "2026-11-13T14:13:13.256Z"
+ "dateUpdated": "2026-11-13T16:14:50.322Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T16:05:12.337571Z",
+ "id": "CVE-2026-82177",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T16:14:50.322Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/86xxx/CVE-2026-86323.json b/data/2026/86xxx/CVE-2026-86323.json
index e69848e8bf..e7da70ff8a 100644
--- a/data/2026/86xxx/CVE-2026-86323.json
+++ b/data/2026/86xxx/CVE-2026-86323.json
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-07T06:25:38.505Z",
"datePublished": "2026-11-12T20:19:52.542Z",
- "dateUpdated": "2026-11-13T00:17:18.830Z"
+ "dateUpdated": "2026-11-13T15:39:36.633Z"
},
"containers": {
"cna": {
@@ -218,6 +218,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:39:28.245266Z",
+ "id": "CVE-2026-86323",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "partial"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:39:36.633Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/86xxx/CVE-2026-86355.json b/data/2026/86xxx/CVE-2026-86355.json
index e210ee2b72..bf5432b207 100644
--- a/data/2026/86xxx/CVE-2026-86355.json
+++ b/data/2026/86xxx/CVE-2026-86355.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-09-07T10:04:28.180Z",
"datePublished": "2026-11-13T12:31:37.762Z",
- "dateUpdated": "2026-11-13T12:31:37.762Z"
+ "dateUpdated": "2026-11-13T15:52:42.285Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:35:41.902083Z",
+ "id": "CVE-2026-86355",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:52:42.285Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/86xxx/CVE-2026-86356.json b/data/2026/86xxx/CVE-2026-86356.json
index 8e7d314c81..06024535b2 100644
--- a/data/2026/86xxx/CVE-2026-86356.json
+++ b/data/2026/86xxx/CVE-2026-86356.json
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-09-07T10:04:28.181Z",
"datePublished": "2026-11-13T12:20:53.059Z",
- "dateUpdated": "2026-11-13T12:59:08.905Z"
+ "dateUpdated": "2026-11-13T15:51:22.345Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
- }
+ },
+ "adp": [
+ {
+ "metrics": [
+ {
+ "other": {
+ "type": "ssvc",
+ "content": {
+ "timestamp": "2026-11-13T15:51:06.375031Z",
+ "id": "CVE-2026-86356",
+ "options": [
+ {
+ "Exploitation": "none"
+ },
+ {
+ "Automatable": "no"
+ },
+ {
+ "Technical Impact": "total"
+ }
+ ],
+ "role": "CISA Coordinator",
+ "version": "2.0.3"
+ }
+ }
+ }
+ ],
+ "title": "CISA ADP Vulnrichment",
+ "providerMetadata": {
+ "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
+ "shortName": "CISA-ADP",
+ "dateUpdated": "2026-11-13T15:51:22.345Z"
+ }
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/data/2026/95xxx/CVE-2026-95377.json b/data/2026/95xxx/CVE-2026-95377.json
new file mode 100644
index 0000000000..f6a2153928
--- /dev/null
+++ b/data/2026/95xxx/CVE-2026-95377.json
@@ -0,0 +1,257 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-95377",
+ "assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "state": "PUBLISHED",
+ "assignerShortName": "Zenitel",
+ "dateReserved": "2026-09-22T05:16:14.448Z",
+ "datePublished": "2026-11-13T15:47:10.537Z",
+ "dateUpdated": "2026-11-13T15:47:10.537Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "shortName": "Zenitel",
+ "dateUpdated": "2026-11-13T15:47:10.537Z"
+ },
+ "title": "OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning",
+ "datePublic": "2026-11-13T15:47:00.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-78",
+ "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF6",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "32 bit"
+ ],
+ "packageName": "EdgeAudioClient",
+ "modules": [
+ "TFTP provisioning"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "9.6.3.0",
+ "versionType": "custom"
+ },
+ {
+ "status": "affected",
+ "version": "10.0.0.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "EdgeAudioClient",
+ "modules": [
+ "TFTP provisioning"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "9.6.3.0",
+ "versionType": "custom"
+ },
+ {
+ "status": "affected",
+ "version": "10.0.0.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8MP",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "EdgeAudioClient",
+ "modules": [
+ "TFTP provisioning"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "9.6.3.0",
+ "versionType": "custom"
+ },
+ {
+ "status": "affected",
+ "version": "10.0.0.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8MN",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "EdgeAudioClient",
+ "modules": [
+ "TFTP provisioning"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "9.6.3.0",
+ "versionType": "custom"
+ },
+ {
+ "status": "affected",
+ "version": "10.0.0.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFT",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "32 bit"
+ ],
+ "packageName": "EdgeAudioClient",
+ "modules": [
+ "TFTP provisioning"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "9.6.3.0",
+ "versionType": "custom"
+ },
+ {
+ "status": "affected",
+ "version": "10.0.0.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\n\n\n\nThe same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.
The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.
"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "ADJACENT",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "subConfidentialityImpact": "HIGH",
+ "vulnIntegrityImpact": "HIGH",
+ "subIntegrityImpact": "HIGH",
+ "vulnAvailabilityImpact": "HIGH",
+ "subAvailabilityImpact": "HIGH",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "PRESENT",
+ "Automatable": "YES",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "CRITICAL",
+ "baseScore": 9.4,
+ "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment."
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security",
+ "type": "finder"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "x_generator": {
+ "engine": "Vulnogram 1.0.5"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/95xxx/CVE-2026-95378.json b/data/2026/95xxx/CVE-2026-95378.json
new file mode 100644
index 0000000000..1049e1cce3
--- /dev/null
+++ b/data/2026/95xxx/CVE-2026-95378.json
@@ -0,0 +1,266 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-95378",
+ "assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "state": "PUBLISHED",
+ "assignerShortName": "Zenitel",
+ "dateReserved": "2026-09-22T05:16:24.841Z",
+ "datePublished": "2026-11-13T15:45:14.968Z",
+ "dateUpdated": "2026-11-13T15:45:14.968Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "shortName": "Zenitel",
+ "dateUpdated": "2026-11-13T15:45:14.968Z"
+ },
+ "title": "Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root",
+ "datePublic": "2026-11-13T15:45:00.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-22",
+ "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-434",
+ "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "impacts": [
+ {
+ "capecId": "CAPEC-126",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "CAPEC-126 Path Traversal"
+ }
+ ]
+ },
+ {
+ "capecId": "CAPEC-23",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "CAPEC-23 File Content Injection"
+ }
+ ]
+ },
+ {
+ "capecId": "CAPEC-165",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "CAPEC-165 File Manipulation"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF6",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "32 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate upload"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate upload"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8MP",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate upload"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8MN",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate upload"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFT",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "32 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate upload"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "subConfidentialityImpact": "LOW",
+ "vulnIntegrityImpact": "HIGH",
+ "subIntegrityImpact": "LOW",
+ "vulnAvailabilityImpact": "HIGH",
+ "subAvailabilityImpact": "LOW",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "PRESENT",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "HIGH",
+ "baseScore": 8.6,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Affected devices should upgrade to version 10.1.3.0 (and newer).",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security",
+ "type": "finder"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "x_generator": {
+ "engine": "Vulnogram 1.0.5"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/95xxx/CVE-2026-95379.json b/data/2026/95xxx/CVE-2026-95379.json
new file mode 100644
index 0000000000..ba58e0887c
--- /dev/null
+++ b/data/2026/95xxx/CVE-2026-95379.json
@@ -0,0 +1,247 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-95379",
+ "assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "state": "PUBLISHED",
+ "assignerShortName": "Zenitel",
+ "dateReserved": "2026-09-22T05:16:26.266Z",
+ "datePublished": "2026-11-13T15:43:32.974Z",
+ "dateUpdated": "2026-11-13T15:43:32.974Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "shortName": "Zenitel",
+ "dateUpdated": "2026-11-13T15:43:32.974Z"
+ },
+ "title": "Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root",
+ "datePublic": "2026-11-13T15:43:00.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-23",
+ "description": "CWE-23 Relative Path Traversal",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "impacts": [
+ {
+ "capecId": "CAPEC-126",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "CAPEC-126 Path Traversal"
+ }
+ ]
+ },
+ {
+ "capecId": "CAPEC-165",
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "CAPEC-165 File Manipulation"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF6",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "32 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate delete"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate delete"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8MP",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate delete"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFF8MN",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "64 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate delete"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ },
+ {
+ "vendor": "Zenitel",
+ "product": "VSFT",
+ "platforms": [
+ "Linux",
+ "ARM",
+ "32 bit"
+ ],
+ "packageName": "turbineweb",
+ "modules": [
+ "Certificate delete"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "10.0.3.0",
+ "lessThan": "10.1.3.0",
+ "versionType": "custom"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.\n\n\n\nThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "NONE",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "HIGH",
+ "subIntegrityImpact": "LOW",
+ "vulnAvailabilityImpact": "HIGH",
+ "subAvailabilityImpact": "LOW",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "PRESENT",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "HIGH",
+ "baseScore": 7,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/S:P"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Affected devices should upgrade to version 10.1.3.0 (and newer).",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security",
+ "type": "finder"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "x_generator": {
+ "engine": "Vulnogram 1.0.5"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/data/2026/95xxx/CVE-2026-95613.json b/data/2026/95xxx/CVE-2026-95613.json
new file mode 100644
index 0000000000..0f100d6668
--- /dev/null
+++ b/data/2026/95xxx/CVE-2026-95613.json
@@ -0,0 +1,150 @@
+{
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.2",
+ "cveMetadata": {
+ "cveId": "CVE-2026-95613",
+ "assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "state": "PUBLISHED",
+ "assignerShortName": "Zenitel",
+ "dateReserved": "2026-09-22T09:55:19.680Z",
+ "datePublished": "2026-11-13T15:44:28.709Z",
+ "dateUpdated": "2026-11-13T15:44:28.709Z"
+ },
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
+ "shortName": "Zenitel",
+ "dateUpdated": "2026-11-13T15:44:28.709Z"
+ },
+ "title": "Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim",
+ "datePublic": "2026-11-13T15:44:00.000Z",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-266",
+ "description": "CWE-266 Incorrect privilege assignment",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-250",
+ "description": "CWE-250 Execution with unnecessary privileges",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "lang": "en",
+ "cweId": "CWE-653",
+ "description": "CWE-653 Improper isolation or compartmentalization",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "affected": [
+ {
+ "vendor": "Zenitel",
+ "product": "Zenitel Connect",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.11.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "value": "The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the \"postgres\" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the \"postgres\" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API."
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "NONE",
+ "privilegesRequired": "HIGH",
+ "userInteraction": "NONE",
+ "vulnConfidentialityImpact": "HIGH",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "HIGH",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "HIGH",
+ "subAvailabilityImpact": "NONE",
+ "exploitMaturity": "NOT_DEFINED",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "version": "4.0",
+ "baseSeverity": "HIGH",
+ "baseScore": 8.6,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+ }
+ }
+ ],
+ "solutions": [
+ {
+ "lang": "en",
+ "value": "Upgrade to version 1.11.0",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Upgrade to version 1.11.0
Upgrade to version 1.11.0
Upgrade to version 1.11.0