From 629b6d7aadd499b558c13fc9e8972d23fdcaf356 Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Wed, 11 Nov 2026 15:43:15 +0100 Subject: [PATCH] CVE sync 2026-11-11T14:43:10Z --- data/2026/0xxx/CVE-2026-0470.json | 144 ++++ data/2026/100xxx/CVE-2026-100236.json | 30 +- data/2026/103xxx/CVE-2026-103503.json | 7 +- data/2026/105xxx/CVE-2026-105150.json | 38 +- data/2026/105xxx/CVE-2026-105274.json | 229 +++--- data/2026/105xxx/CVE-2026-105280.json | 7 +- data/2026/105xxx/CVE-2026-105668.json | 7 +- data/2026/114xxx/CVE-2026-114690.json | 76 +- data/2026/114xxx/CVE-2026-114691.json | 76 +- data/2026/115xxx/CVE-2026-115455.json | 76 +- data/2026/115xxx/CVE-2026-115456.json | 76 +- data/2026/119xxx/CVE-2026-119097.json | 38 +- data/2026/119xxx/CVE-2026-119777.json | 22 +- data/2026/120xxx/CVE-2026-120286.json | 9 +- data/2026/120xxx/CVE-2026-120295.json | 9 +- data/2026/120xxx/CVE-2026-120730.json | 9 +- data/2026/120xxx/CVE-2026-120997.json | 9 +- data/2026/120xxx/CVE-2026-120999.json | 9 +- data/2026/121xxx/CVE-2026-121629.json | 22 +- data/2026/121xxx/CVE-2026-121770.json | 38 +- data/2026/121xxx/CVE-2026-121773.json | 38 +- data/2026/123xxx/CVE-2026-123040.json | 139 ++++ data/2026/123xxx/CVE-2026-123473.json | 38 +- data/2026/123xxx/CVE-2026-123478.json | 41 +- data/2026/123xxx/CVE-2026-123480.json | 38 +- data/2026/124xxx/CVE-2026-124250.json | 38 +- data/2026/124xxx/CVE-2026-124253.json | 38 +- data/2026/124xxx/CVE-2026-124256.json | 38 +- data/2026/124xxx/CVE-2026-124257.json | 38 +- data/2026/124xxx/CVE-2026-124263.json | 38 +- data/2026/124xxx/CVE-2026-124411.json | 38 +- data/2026/124xxx/CVE-2026-124752.json | 38 +- data/2026/125xxx/CVE-2026-125045.json | 38 +- data/2026/125xxx/CVE-2026-125433.json | 38 +- data/2026/125xxx/CVE-2026-125445.json | 38 +- data/2026/125xxx/CVE-2026-125446.json | 38 +- data/2026/125xxx/CVE-2026-125450.json | 38 +- data/2026/125xxx/CVE-2026-125451.json | 38 +- data/2026/125xxx/CVE-2026-125454.json | 38 +- data/2026/125xxx/CVE-2026-125455.json | 38 +- data/2026/125xxx/CVE-2026-125680.json | 38 +- data/2026/125xxx/CVE-2026-125708.json | 38 +- data/2026/125xxx/CVE-2026-125743.json | 38 +- data/2026/125xxx/CVE-2026-125761.json | 38 +- data/2026/125xxx/CVE-2026-125762.json | 38 +- data/2026/125xxx/CVE-2026-125781.json | 38 +- data/2026/125xxx/CVE-2026-125784.json | 38 +- data/2026/125xxx/CVE-2026-125838.json | 120 +++ data/2026/125xxx/CVE-2026-125839.json | 120 +++ data/2026/125xxx/CVE-2026-125840.json | 120 +++ data/2026/125xxx/CVE-2026-125841.json | 120 +++ data/2026/125xxx/CVE-2026-125842.json | 120 +++ data/2026/125xxx/CVE-2026-125843.json | 154 ++++ data/2026/125xxx/CVE-2026-125844.json | 154 ++++ data/2026/125xxx/CVE-2026-125845.json | 154 ++++ data/2026/125xxx/CVE-2026-125846.json | 154 ++++ data/2026/125xxx/CVE-2026-125847.json | 154 ++++ data/2026/125xxx/CVE-2026-125848.json | 154 ++++ data/2026/125xxx/CVE-2026-125849.json | 154 ++++ data/2026/125xxx/CVE-2026-125850.json | 38 +- data/2026/125xxx/CVE-2026-125879.json | 38 +- data/2026/12xxx/CVE-2026-12424.json | 38 +- data/2026/12xxx/CVE-2026-12427.json | 38 +- data/2026/15xxx/CVE-2026-15785.json | 38 +- data/2026/32xxx/CVE-2026-32146.json | 5 +- data/2026/48xxx/CVE-2026-48859.json | 17 +- data/2026/49xxx/CVE-2026-49236.json | 105 +++ data/2026/55xxx/CVE-2026-55951.json | 103 +-- data/2026/59xxx/CVE-2026-59696.json | 80 +- data/2026/65xxx/CVE-2026-65634.json | 6 +- data/2026/66xxx/CVE-2026-66357.json | 118 +-- data/2026/66xxx/CVE-2026-66835.json | 110 +-- data/2026/68xxx/CVE-2026-68956.json | 6 +- data/2026/69xxx/CVE-2026-69664.json | 6 +- data/2026/70xxx/CVE-2026-70399.json | 81 +- data/2026/70xxx/CVE-2026-70405.json | 103 +-- data/2026/70xxx/CVE-2026-70409.json | 80 +- data/2026/71xxx/CVE-2026-71380.json | 96 +-- data/2026/71xxx/CVE-2026-71562.json | 103 +-- data/2026/73xxx/CVE-2026-73270.json | 110 +-- data/2026/73xxx/CVE-2026-73276.json | 89 ++- data/2026/73xxx/CVE-2026-73812.json | 104 +-- data/2026/74xxx/CVE-2026-74835.json | 116 +-- data/2026/74xxx/CVE-2026-74860.json | 50 +- data/2026/74xxx/CVE-2026-74994.json | 116 +-- data/2026/75xxx/CVE-2026-75538.json | 102 +-- data/2026/81xxx/CVE-2026-81856.json | 26 +- data/2026/84xxx/CVE-2026-84268.json | 30 +- data/2026/86xxx/CVE-2026-86320.json | 30 +- data/2026/86xxx/CVE-2026-86561.json | 30 +- data/2026/86xxx/CVE-2026-86562.json | 30 +- data/2026/86xxx/CVE-2026-86563.json | 30 +- data/2026/86xxx/CVE-2026-86565.json | 30 +- data/2026/86xxx/CVE-2026-86566.json | 30 +- data/2026/86xxx/CVE-2026-86567.json | 30 +- data/2026/86xxx/CVE-2026-86845.json | 30 +- data/2026/86xxx/CVE-2026-86846.json | 30 +- data/2026/86xxx/CVE-2026-86847.json | 30 +- data/2026/86xxx/CVE-2026-86848.json | 30 +- data/2026/86xxx/CVE-2026-86849.json | 30 +- data/2026/86xxx/CVE-2026-86856.json | 30 +- data/2026/88xxx/CVE-2026-88924.json | 30 +- data/2026/91xxx/CVE-2026-91000.json | 38 +- data/2026/93xxx/CVE-2026-93427.json | 38 +- data/2026/93xxx/CVE-2026-93683.json | 30 +- data/2026/96xxx/CVE-2026-96275.json | 30 +- data/2026/96xxx/CVE-2026-96280.json | 30 +- data/2026/96xxx/CVE-2026-96612.json | 9 +- data/2026/96xxx/CVE-2026-96618.json | 7 +- data/2026/97xxx/CVE-2026-97023.json | 30 +- data/2026/97xxx/CVE-2026-97024.json | 30 +- data/delta.json | 74 +- data/deltaLog.json | 1059 +++++++++++++++++++------ state/sync.json | 6 +- 114 files changed, 6223 insertions(+), 1269 deletions(-) create mode 100644 data/2026/0xxx/CVE-2026-0470.json create mode 100644 data/2026/123xxx/CVE-2026-123040.json create mode 100644 data/2026/125xxx/CVE-2026-125838.json create mode 100644 data/2026/125xxx/CVE-2026-125839.json create mode 100644 data/2026/125xxx/CVE-2026-125840.json create mode 100644 data/2026/125xxx/CVE-2026-125841.json create mode 100644 data/2026/125xxx/CVE-2026-125842.json create mode 100644 data/2026/125xxx/CVE-2026-125843.json create mode 100644 data/2026/125xxx/CVE-2026-125844.json create mode 100644 data/2026/125xxx/CVE-2026-125845.json create mode 100644 data/2026/125xxx/CVE-2026-125846.json create mode 100644 data/2026/125xxx/CVE-2026-125847.json create mode 100644 data/2026/125xxx/CVE-2026-125848.json create mode 100644 data/2026/125xxx/CVE-2026-125849.json create mode 100644 data/2026/49xxx/CVE-2026-49236.json diff --git a/data/2026/0xxx/CVE-2026-0470.json b/data/2026/0xxx/CVE-2026-0470.json new file mode 100644 index 0000000000..cff94a1fae --- /dev/null +++ b/data/2026/0xxx/CVE-2026-0470.json @@ -0,0 +1,144 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-0470", + "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", + "state": "PUBLISHED", + "assignerShortName": "AMD", + "dateReserved": "2025-12-06T15:11:25.632Z", + "datePublished": "2026-11-11T13:27:10.327Z", + "dateUpdated": "2026-11-11T13:27:10.327Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", + "shortName": "AMD", + "dateUpdated": "2026-11-11T13:27:10.327Z" + }, + "affected": [ + { + "defaultStatus": "affected", + "vendor": "AMD", + "product": "AMD EPYC™ Embedded 3000 Series Processors", + "versions": [ + { + "version": "Embedded Snowyowl Chipset Driver - 8.10.28.647 (73744e)", + "status": "unaffected" + } + ] + }, + { + "defaultStatus": "affected", + "vendor": "AMD", + "product": "AMD Ryzen™ Embedded R1000 Series Processors", + "versions": [ + { + "version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)", + "status": "unaffected" + } + ] + }, + { + "defaultStatus": "affected", + "vendor": "AMD", + "product": "AMD Ryzen™ Embedded R2000 Series Processors", + "versions": [ + { + "version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)", + "status": "unaffected" + } + ] + }, + { + "defaultStatus": "affected", + "vendor": "AMD", + "product": "AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")", + "versions": [ + { + "version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)", + "status": "unaffected" + } + ] + }, + { + "defaultStatus": "affected", + "vendor": "AMD", + "product": "AMD Ryzen™ Embedded V2000 Series Processors", + "versions": [ + { + "version": "Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)", + "status": "unaffected" + } + ] + } + ], + "datePublic": "2026-11-11T13:22:36.129Z", + "descriptions": [ + { + "lang": "en", + "value": "Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.
" + } + ] + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-476", + "description": "CWE-476 NULL Pointer Dereference", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "references": [ + { + "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5010.html" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "x_generator": { + "engine": "AMD PSIRT Automation 1.0" + }, + "metrics": [ + { + "cvssV4_0": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "HIGH", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "baseScore": 6.8, + "baseSeverity": "MEDIUM" + }, + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/100xxx/CVE-2026-100236.json b/data/2026/100xxx/CVE-2026-100236.json index 2eab6b77fe..63479de391 100644 --- a/data/2026/100xxx/CVE-2026-100236.json +++ b/data/2026/100xxx/CVE-2026-100236.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-25T16:00:50.249Z", "datePublished": "2026-10-14T16:33:25.792Z", - "dateUpdated": "2026-11-11T12:15:11.044Z" + "dateUpdated": "2026-11-11T13:51:02.820Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-100236", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:15:11.044Z" + "dateUpdated": "2026-11-11T13:51:02.820Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/103xxx/CVE-2026-103503.json b/data/2026/103xxx/CVE-2026-103503.json index bc0afc8cab..c9669ad2a4 100644 --- a/data/2026/103xxx/CVE-2026-103503.json +++ b/data/2026/103xxx/CVE-2026-103503.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-10-08T15:45:02.372Z", "datePublished": "2026-10-12T15:17:45.545Z", - "dateUpdated": "2026-10-16T17:32:45.735Z" + "dateUpdated": "2026-11-11T14:04:54.738Z" }, "containers": { "cna": { @@ -22,7 +22,7 @@ "'Elixir.Hex.HTTP.SSL'" ], "packageName": "hex", - "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", + "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": [ "lib/hex/http/ssl.ex" @@ -146,6 +146,7 @@ } ], "dateAssigned": "2026-10-10T12:59:48.000Z", + "datePublic": "2026-10-12T15:17:45.000Z", "descriptions": [ { "lang": "en", @@ -236,7 +237,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-10-12T15:17:45.545Z" + "dateUpdated": "2026-11-11T14:04:54.738Z" }, "references": [ { diff --git a/data/2026/105xxx/CVE-2026-105150.json b/data/2026/105xxx/CVE-2026-105150.json index e0b28bd5af..065a84ffbc 100644 --- a/data/2026/105xxx/CVE-2026-105150.json +++ b/data/2026/105xxx/CVE-2026-105150.json @@ -8,7 +8,7 @@ "assignerShortName": "Wordfence", "dateReserved": "2026-10-03T18:28:29.530Z", "datePublished": "2026-11-10T21:28:26.108Z", - "dateUpdated": "2026-11-10T21:28:26.108Z" + "dateUpdated": "2026-11-11T13:49:19.498Z" }, "containers": { "cna": { @@ -103,6 +103,40 @@ "value": "Disclosed" } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:40:06.668955Z", + "id": "CVE-2026-105150", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:19.498Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/105xxx/CVE-2026-105274.json b/data/2026/105xxx/CVE-2026-105274.json index c49d9c945e..6ade9cb5f8 100644 --- a/data/2026/105xxx/CVE-2026-105274.json +++ b/data/2026/105xxx/CVE-2026-105274.json @@ -8,94 +8,11 @@ "assignerShortName": "EEF", "dateReserved": "2026-10-10T13:00:02.355Z", "datePublished": "2026-10-12T16:43:58.730Z", - "dateUpdated": "2026-10-15T18:05:12.446Z" + "dateUpdated": "2026-11-11T14:05:54.298Z" }, "containers": { "cna": { "affected": [ - { - "cpes": [ - "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*" - ], - "defaultStatus": "unaffected", - "modules": [ - "r3_hex_repo", - "r3_hex_api" - ], - "packageName": "rebar3", - "packageURL": "pkg:otp/rebar3?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Frebar3.git", - "product": "rebar3", - "programFiles": [ - "apps/rebar/src/vendored/r3_hex_repo.erl", - "apps/rebar/src/vendored/r3_hex_api.erl" - ], - "programRoutines": [ - { - "name": "r3_hex_repo:get_names/1" - }, - { - "name": "r3_hex_repo:get_versions/1" - }, - { - "name": "r3_hex_repo:get_package/2" - }, - { - "name": "r3_hex_api:request/4" - } - ], - "repo": "https://github.com/erlang/rebar3", - "vendor": "erlang", - "versions": [ - { - "lessThan": "3.27.3", - "status": "affected", - "version": "3.9.1", - "versionType": "semver" - } - ] - }, - { - "collectionURL": "https://github.com", - "cpes": [ - "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*" - ], - "defaultStatus": "unaffected", - "modules": [ - "r3_hex_repo", - "r3_hex_api" - ], - "packageName": "erlang/rebar3", - "packageURL": "pkg:github/erlang/rebar3", - "product": "rebar3", - "programFiles": [ - "apps/rebar/src/vendored/r3_hex_repo.erl", - "apps/rebar/src/vendored/r3_hex_api.erl" - ], - "programRoutines": [ - { - "name": "r3_hex_repo:get_names/1" - }, - { - "name": "r3_hex_repo:get_versions/1" - }, - { - "name": "r3_hex_repo:get_package/2" - }, - { - "name": "r3_hex_api:request/4" - } - ], - "repo": "https://github.com/erlang/rebar3", - "vendor": "erlang", - "versions": [ - { - "lessThan": "360838a22f5b3a88c0358207f2923059bcbb3afb", - "status": "affected", - "version": "209c02ec57c2cc3207ee0174c3af3675b8dc8f79", - "versionType": "git" - } - ] - }, { "collectionURL": "https://repo.hex.pm", "cpes": [ @@ -196,6 +113,89 @@ } ] }, + { + "cpes": [ + "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "modules": [ + "r3_hex_repo", + "r3_hex_api" + ], + "packageName": "rebar3", + "packageURL": "pkg:otp/rebar3?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Frebar3&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Frebar3.git", + "product": "rebar3", + "programFiles": [ + "apps/rebar/src/vendored/r3_hex_repo.erl", + "apps/rebar/src/vendored/r3_hex_api.erl" + ], + "programRoutines": [ + { + "name": "r3_hex_repo:get_names/1" + }, + { + "name": "r3_hex_repo:get_versions/1" + }, + { + "name": "r3_hex_repo:get_package/2" + }, + { + "name": "r3_hex_api:request/4" + } + ], + "repo": "https://github.com/erlang/rebar3", + "vendor": "erlang", + "versions": [ + { + "lessThan": "3.27.3", + "status": "affected", + "version": "3.9.1", + "versionType": "semver" + } + ] + }, + { + "collectionURL": "https://github.com", + "cpes": [ + "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*" + ], + "defaultStatus": "unaffected", + "modules": [ + "r3_hex_repo", + "r3_hex_api" + ], + "packageName": "erlang/rebar3", + "packageURL": "pkg:github/erlang/rebar3", + "product": "rebar3", + "programFiles": [ + "apps/rebar/src/vendored/r3_hex_repo.erl", + "apps/rebar/src/vendored/r3_hex_api.erl" + ], + "programRoutines": [ + { + "name": "r3_hex_repo:get_names/1" + }, + { + "name": "r3_hex_repo:get_versions/1" + }, + { + "name": "r3_hex_repo:get_package/2" + }, + { + "name": "r3_hex_api:request/4" + } + ], + "repo": "https://github.com/erlang/rebar3", + "vendor": "erlang", + "versions": [ + { + "lessThan": "360838a22f5b3a88c0358207f2923059bcbb3afb", + "status": "affected", + "version": "209c02ec57c2cc3207ee0174c3af3675b8dc8f79", + "versionType": "git" + } + ] + }, { "cpes": [ "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*" @@ -206,7 +206,7 @@ "mix_hex_api" ], "packageName": "hex", - "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", + "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": [ "src/mix_hex_repo.erl", @@ -237,6 +237,12 @@ "status": "affected", "version": "2.1.0", "versionType": "semver" + }, + { + "lessThan": "*", + "status": "affected", + "version": "2.6.0", + "versionType": "semver" } ] }, @@ -309,23 +315,28 @@ "nodes": [ { "cpeMatch": [ - { - "criteria": "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*", - "versionEndExcluding": "3.27.3", - "versionStartIncluding": "3.9.1", - "vulnerable": true - }, { "criteria": "cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.20.0", "versionStartIncluding": "0.1.0", "vulnerable": true }, + { + "criteria": "cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*", + "versionEndExcluding": "3.27.3", + "versionStartIncluding": "3.9.1", + "vulnerable": true + }, { "criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.5.2", "versionStartIncluding": "2.1.0", "vulnerable": true + }, + { + "criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*", + "versionStartIncluding": "2.6.0", + "vulnerable": true } ], "negate": false, @@ -361,15 +372,15 @@ { "base64": false, "type": "text/html", - "value": "

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api).

\n

hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.

\n

hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size.

\n

This issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0.

" + "value": "

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api).

\n

hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.

\n

hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size.

\n

This issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2 and from 2.6.0 onward; hex_core: from 0.1.0 before 0.20.0.

" }, { "base64": false, "type": "text/markdown", - "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (`mix_hex_repo`, `mix_hex_api`) and rebar3 (`r3_hex_repo`, `r3_hex_api`).\n\n`hex_repo:get_names/1`, `hex_repo:get_versions/1`, `hex_repo:get_package/2` and `hex_repo:get_policy/2` decompress the registry response with `zlib:gunzip/1` and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.\n\n`hex_api` decodes responses with the `application/vnd.hex+erlang` content type through `hex_safe_binary_to_term:safe_binary_to_term/1`, which calls `binary_to_term(Binary, [safe])`. The `safe` option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the `safe` option and that check without bounding the decoded size.\n\nThis issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0." + "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (`mix_hex_repo`, `mix_hex_api`) and rebar3 (`r3_hex_repo`, `r3_hex_api`).\n\n`hex_repo:get_names/1`, `hex_repo:get_versions/1`, `hex_repo:get_package/2` and `hex_repo:get_policy/2` decompress the registry response with `zlib:gunzip/1` and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.\n\n`hex_api` decodes responses with the `application/vnd.hex+erlang` content type through `hex_safe_binary_to_term:safe_binary_to_term/1`, which calls `binary_to_term(Binary, [safe])`. The `safe` option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the `safe` option and that check without bounding the decoded size.\n\nThis issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2 and from 2.6.0 onward; hex_core: from 0.1.0 before 0.20.0." } ], - "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api).\n\nhex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.\n\nhex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size.\n\nThis issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2; hex_core: from 0.1.0 before 0.20.0." + "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api).\n\nhex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.\n\nhex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding the decoded size.\n\nThis issue affects rebar3: from 3.9.1 before 3.27.3; hex: from 2.1.0 before 2.5.2 and from 2.6.0 onward; hex_core: from 0.1.0 before 0.20.0." } ], "impacts": [ @@ -444,7 +455,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-10-12T18:16:57.155Z" + "dateUpdated": "2026-11-11T14:05:54.298Z" }, "references": [ { @@ -469,20 +480,6 @@ ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-105274" }, - { - "name": "Introducing commit 209c02e in erlang/rebar3", - "tags": [ - "related" - ], - "url": "https://github.com/erlang/rebar3/commit/209c02ec57c2cc3207ee0174c3af3675b8dc8f79" - }, - { - "name": "Fix commit 360838a in erlang/rebar3", - "tags": [ - "patch" - ], - "url": "https://github.com/erlang/rebar3/commit/360838a22f5b3a88c0358207f2923059bcbb3afb" - }, { "name": "Introducing commit fbb6d9d in hexpm/hex_core", "tags": [ @@ -497,6 +494,20 @@ ], "url": "https://github.com/hexpm/hex_core/commit/ebe25d110717f6a3addba5232cd4a7dc1c76b628" }, + { + "name": "Introducing commit 209c02e in erlang/rebar3", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/rebar3/commit/209c02ec57c2cc3207ee0174c3af3675b8dc8f79" + }, + { + "name": "Fix commit 360838a in erlang/rebar3", + "tags": [ + "patch" + ], + "url": "https://github.com/erlang/rebar3/commit/360838a22f5b3a88c0358207f2923059bcbb3afb" + }, { "name": "Introducing commit 671f695 in hexpm/hex", "tags": [ diff --git a/data/2026/105xxx/CVE-2026-105280.json b/data/2026/105xxx/CVE-2026-105280.json index d641d9958d..896a0f381d 100644 --- a/data/2026/105xxx/CVE-2026-105280.json +++ b/data/2026/105xxx/CVE-2026-105280.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-10-08T13:45:02.134Z", "datePublished": "2026-10-12T15:30:14.126Z", - "dateUpdated": "2026-10-16T17:37:21.498Z" + "dateUpdated": "2026-11-11T14:03:00.287Z" }, "containers": { "cna": { @@ -23,7 +23,7 @@ "'Elixir.Hex.SCM'" ], "packageName": "hex", - "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", + "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": [ "lib/mix/tasks/hex.package.ex", @@ -150,6 +150,7 @@ } ], "dateAssigned": "2026-10-10T13:01:30.000Z", + "datePublic": "2026-10-12T15:30:14.000Z", "descriptions": [ { "lang": "en", @@ -240,7 +241,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-10-12T15:30:14.126Z" + "dateUpdated": "2026-11-11T14:03:00.287Z" }, "references": [ { diff --git a/data/2026/105xxx/CVE-2026-105668.json b/data/2026/105xxx/CVE-2026-105668.json index 53d3a8e77b..3ba1ef7256 100644 --- a/data/2026/105xxx/CVE-2026-105668.json +++ b/data/2026/105xxx/CVE-2026-105668.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-10-07T22:15:01.885Z", "datePublished": "2026-10-12T15:31:58.926Z", - "dateUpdated": "2026-10-16T17:38:34.235Z" + "dateUpdated": "2026-11-11T14:02:17.237Z" }, "containers": { "cna": { @@ -23,7 +23,7 @@ "'Elixir.Hex.Registry.Cooldown'" ], "packageName": "hex", - "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", + "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": [ "lib/hex/remote_converger.ex", @@ -161,6 +161,7 @@ } ], "dateAssigned": "2026-10-10T13:01:56.000Z", + "datePublic": "2026-10-12T15:31:59.000Z", "descriptions": [ { "lang": "en", @@ -251,7 +252,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-10-12T15:31:58.926Z" + "dateUpdated": "2026-11-11T14:02:17.237Z" }, "references": [ { diff --git a/data/2026/114xxx/CVE-2026-114690.json b/data/2026/114xxx/CVE-2026-114690.json index e9693f5bf1..3de0648089 100644 --- a/data/2026/114xxx/CVE-2026-114690.json +++ b/data/2026/114xxx/CVE-2026-114690.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-21T22:14:31.928Z", "datePublished": "2026-10-30T07:13:04.008Z", - "dateUpdated": "2026-11-11T12:38:11.959Z" + "dateUpdated": "2026-11-11T14:04:00.142Z" }, "containers": { "cna": { @@ -48,6 +48,42 @@ } ], "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-15-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:15.2.1-8.2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-16-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:16.2.1-1.4.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -164,26 +200,6 @@ "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-15-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-16-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -740,6 +756,22 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98633", + "name": "RHSA-2026:98633", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98640", + "name": "RHSA-2026:98640", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98648", "name": "RHSA-2026:98648", @@ -805,7 +837,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:38:11.959Z" + "dateUpdated": "2026-11-11T14:04:00.142Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/114xxx/CVE-2026-114691.json b/data/2026/114xxx/CVE-2026-114691.json index 09b73af8e1..d1771352d2 100644 --- a/data/2026/114xxx/CVE-2026-114691.json +++ b/data/2026/114xxx/CVE-2026-114691.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-21T22:16:10.067Z", "datePublished": "2026-10-30T07:13:05.891Z", - "dateUpdated": "2026-11-11T12:38:11.970Z" + "dateUpdated": "2026-11-11T14:04:00.245Z" }, "containers": { "cna": { @@ -48,6 +48,42 @@ } ], "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-15-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:15.2.1-8.2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-16-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:16.2.1-1.4.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -164,26 +200,6 @@ "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-15-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-16-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -740,6 +756,22 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98633", + "name": "RHSA-2026:98633", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98640", + "name": "RHSA-2026:98640", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98648", "name": "RHSA-2026:98648", @@ -805,7 +837,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:38:11.970Z" + "dateUpdated": "2026-11-11T14:04:00.245Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/115xxx/CVE-2026-115455.json b/data/2026/115xxx/CVE-2026-115455.json index 7824e7b735..760edce15d 100644 --- a/data/2026/115xxx/CVE-2026-115455.json +++ b/data/2026/115xxx/CVE-2026-115455.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-22T15:06:48.490Z", "datePublished": "2026-10-30T07:13:06.547Z", - "dateUpdated": "2026-11-11T12:38:16.540Z" + "dateUpdated": "2026-11-11T14:04:00.225Z" }, "containers": { "cna": { @@ -48,6 +48,42 @@ } ], "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-15-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:15.2.1-8.2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-16-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:16.2.1-1.4.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -102,26 +138,6 @@ "cpe:/a:redhat:hummingbird:1" ] }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-15-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-16-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -360,6 +376,22 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98633", + "name": "RHSA-2026:98633", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98640", + "name": "RHSA-2026:98640", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98648", "name": "RHSA-2026:98648", @@ -422,7 +454,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:38:16.540Z" + "dateUpdated": "2026-11-11T14:04:00.225Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/115xxx/CVE-2026-115456.json b/data/2026/115xxx/CVE-2026-115456.json index c03d73a0e2..f7efba14ed 100644 --- a/data/2026/115xxx/CVE-2026-115456.json +++ b/data/2026/115xxx/CVE-2026-115456.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-22T15:06:48.490Z", "datePublished": "2026-10-30T08:21:50.361Z", - "dateUpdated": "2026-11-11T12:38:22.898Z" + "dateUpdated": "2026-11-11T14:04:29.305Z" }, "containers": { "cna": { @@ -48,6 +48,42 @@ } ], "affected": [ + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-15-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:15.2.1-8.2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gcc-toolset-16-gcc", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:16.2.1-1.4.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -124,26 +160,6 @@ "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-15-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, - { - "vendor": "Red Hat", - "product": "Red Hat Enterprise Linux 10", - "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", - "packageName": "gcc-toolset-16-gcc", - "defaultStatus": "affected", - "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" - ] - }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", @@ -702,6 +718,22 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98633", + "name": "RHSA-2026:98633", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98640", + "name": "RHSA-2026:98640", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98648", "name": "RHSA-2026:98648", @@ -761,7 +793,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:38:22.898Z" + "dateUpdated": "2026-11-11T14:04:29.305Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/119xxx/CVE-2026-119097.json b/data/2026/119xxx/CVE-2026-119097.json index 0e083de009..d264a8788c 100644 --- a/data/2026/119xxx/CVE-2026-119097.json +++ b/data/2026/119xxx/CVE-2026-119097.json @@ -8,7 +8,7 @@ "assignerShortName": "Wordfence", "dateReserved": "2026-10-29T13:58:37.919Z", "datePublished": "2026-11-11T11:31:08.076Z", - "dateUpdated": "2026-11-11T11:31:08.076Z" + "dateUpdated": "2026-11-11T13:46:51.362Z" }, "containers": { "cna": { @@ -89,6 +89,40 @@ "value": "Disclosed" } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:32.822678Z", + "id": "CVE-2026-119097", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:46:51.362Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/119xxx/CVE-2026-119777.json b/data/2026/119xxx/CVE-2026-119777.json index bce7f3b33d..cf635751de 100644 --- a/data/2026/119xxx/CVE-2026-119777.json +++ b/data/2026/119xxx/CVE-2026-119777.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-10-30T16:19:44.205Z", "datePublished": "2026-10-30T17:59:41.041Z", - "dateUpdated": "2026-11-04T22:06:21.999Z" + "dateUpdated": "2026-11-11T13:51:31.269Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "gstreamer1-plugins-bad-free", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.26.7-9.el10_3.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -90,6 +98,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:98621", + "name": "RHSA-2026:98621", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-119777", "tags": [ @@ -144,7 +160,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-04T22:06:21.999Z" + "dateUpdated": "2026-11-11T13:51:31.269Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/120xxx/CVE-2026-120286.json b/data/2026/120xxx/CVE-2026-120286.json index f3411542e5..da3bb0c159 100644 --- a/data/2026/120xxx/CVE-2026-120286.json +++ b/data/2026/120xxx/CVE-2026-120286.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-11-04T17:15:01.545Z", "datePublished": "2026-11-10T10:44:07.907Z", - "dateUpdated": "2026-11-10T10:44:07.907Z" + "dateUpdated": "2026-11-11T14:01:13.773Z" }, "containers": { "cna": { @@ -25,7 +25,7 @@ "'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'", "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'" ], - "packageName": "nerves-hub/nerves-hub", + "packageName": "nerves-hub", "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub", "product": "nerves_hub_web", "programFiles": [ @@ -76,7 +76,7 @@ "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'" ], "packageName": "nerves_hub", - "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", + "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", "product": "nerves_hub_web", "programFiles": [ "lib/nerves_hub_web/components/device_page/settings_tab.ex", @@ -210,6 +210,7 @@ } ], "dateAssigned": "2026-11-09T22:27:53.000Z", + "datePublic": "2026-11-10T10:44:08.000Z", "descriptions": [ { "lang": "en", @@ -300,7 +301,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-11-10T10:44:07.907Z" + "dateUpdated": "2026-11-11T14:01:13.773Z" }, "references": [ { diff --git a/data/2026/120xxx/CVE-2026-120295.json b/data/2026/120xxx/CVE-2026-120295.json index 5d9f165a84..f8c878c594 100644 --- a/data/2026/120xxx/CVE-2026-120295.json +++ b/data/2026/120xxx/CVE-2026-120295.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-11-06T09:58:06.998Z", "datePublished": "2026-11-10T10:43:26.342Z", - "dateUpdated": "2026-11-10T10:43:26.342Z" + "dateUpdated": "2026-11-11T14:00:26.627Z" }, "containers": { "cna": { @@ -24,7 +24,7 @@ "'Elixir.NervesHub.Products'", "'Elixir.NervesHubWeb.Components.BulkActionsSidebar'" ], - "packageName": "nerves-hub/nerves-hub", + "packageName": "nerves-hub", "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub", "product": "nerves_hub_web", "programFiles": [ @@ -61,7 +61,7 @@ "'Elixir.NervesHubWeb.Components.BulkActionsSidebar'" ], "packageName": "nerves_hub", - "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", + "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", "product": "nerves_hub_web", "programFiles": [ "lib/nerves_hub_web/live/devices/index.ex", @@ -174,6 +174,7 @@ } ], "dateAssigned": "2026-11-09T22:35:49.000Z", + "datePublic": "2026-11-10T10:43:26.000Z", "descriptions": [ { "lang": "en", @@ -264,7 +265,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-11-10T10:43:26.342Z" + "dateUpdated": "2026-11-11T14:00:26.627Z" }, "references": [ { diff --git a/data/2026/120xxx/CVE-2026-120730.json b/data/2026/120xxx/CVE-2026-120730.json index dc19bf9e23..16101ffde8 100644 --- a/data/2026/120xxx/CVE-2026-120730.json +++ b/data/2026/120xxx/CVE-2026-120730.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-11-03T03:45:01.695Z", "datePublished": "2026-11-10T10:43:47.924Z", - "dateUpdated": "2026-11-10T10:43:47.924Z" + "dateUpdated": "2026-11-11T13:59:36.975Z" }, "containers": { "cna": { @@ -29,7 +29,7 @@ "'Elixir.NervesHub.Devices.CACertificate.JITP'", "'Elixir.NervesHub.ManagedDeployments'" ], - "packageName": "nerves-hub/nerves-hub", + "packageName": "nerves-hub", "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub", "product": "nerves_hub_web", "programFiles": [ @@ -94,7 +94,7 @@ "'Elixir.NervesHub.ManagedDeployments'" ], "packageName": "nerves_hub", - "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", + "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", "product": "nerves_hub_web", "programFiles": [ "lib/nerves_hub_web/controllers/api/device_controller.ex", @@ -252,6 +252,7 @@ } ], "dateAssigned": "2026-11-09T22:45:21.000Z", + "datePublic": "2026-11-10T10:43:48.000Z", "descriptions": [ { "lang": "en", @@ -352,7 +353,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-11-10T10:43:47.924Z" + "dateUpdated": "2026-11-11T13:59:36.975Z" }, "references": [ { diff --git a/data/2026/120xxx/CVE-2026-120997.json b/data/2026/120xxx/CVE-2026-120997.json index a0992667f2..74255f158a 100644 --- a/data/2026/120xxx/CVE-2026-120997.json +++ b/data/2026/120xxx/CVE-2026-120997.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-11-05T14:30:01.700Z", "datePublished": "2026-11-10T10:43:57.738Z", - "dateUpdated": "2026-11-10T10:43:57.738Z" + "dateUpdated": "2026-11-11T13:59:03.563Z" }, "containers": { "cna": { @@ -27,7 +27,7 @@ "'Elixir.NervesHubWeb.Auth'", "'Elixir.NervesHub.Accounts'" ], - "packageName": "nerves-hub/nerves-hub", + "packageName": "nerves-hub", "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub", "product": "nerves_hub_web", "programFiles": [ @@ -91,7 +91,7 @@ "'Elixir.NervesHub.Accounts'" ], "packageName": "nerves_hub", - "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", + "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", "product": "nerves_hub_web", "programFiles": [ "lib/nerves_hub_web/channels/user_socket.ex", @@ -249,6 +249,7 @@ } ], "dateAssigned": "2026-11-09T23:03:50.000Z", + "datePublic": "2026-11-10T10:43:58.000Z", "descriptions": [ { "lang": "en", @@ -349,7 +350,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-11-10T10:43:57.738Z" + "dateUpdated": "2026-11-11T13:59:03.563Z" }, "references": [ { diff --git a/data/2026/120xxx/CVE-2026-120999.json b/data/2026/120xxx/CVE-2026-120999.json index ecc9bf91cb..7ede1acdb3 100644 --- a/data/2026/120xxx/CVE-2026-120999.json +++ b/data/2026/120xxx/CVE-2026-120999.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-11-09T22:47:57.298Z", "datePublished": "2026-11-10T10:43:38.941Z", - "dateUpdated": "2026-11-10T10:43:38.941Z" + "dateUpdated": "2026-11-11T13:58:14.140Z" }, "containers": { "cna": { @@ -27,7 +27,7 @@ "'Elixir.NervesHubWeb.Live.Account'", "'Elixir.NervesHubWeb.AccountController'" ], - "packageName": "nerves-hub/nerves-hub", + "packageName": "nerves-hub", "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub", "product": "nerves_hub_web", "programFiles": [ @@ -82,7 +82,7 @@ "'Elixir.NervesHubWeb.AccountController'" ], "packageName": "nerves_hub", - "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", + "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git", "product": "nerves_hub_web", "programFiles": [ "lib/nerves_hub/accounts.ex", @@ -212,6 +212,7 @@ } ], "dateAssigned": "2026-11-09T23:11:54.000Z", + "datePublic": "2026-11-10T10:43:39.000Z", "descriptions": [ { "lang": "en", @@ -312,7 +313,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-11-10T10:43:38.941Z" + "dateUpdated": "2026-11-11T13:58:14.140Z" }, "references": [ { diff --git a/data/2026/121xxx/CVE-2026-121629.json b/data/2026/121xxx/CVE-2026-121629.json index 46a1da6fa5..e1a27b536b 100644 --- a/data/2026/121xxx/CVE-2026-121629.json +++ b/data/2026/121xxx/CVE-2026-121629.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-11-03T16:58:46.246Z", "datePublished": "2026-11-09T11:35:18.991Z", - "dateUpdated": "2026-11-09T11:35:18.991Z" + "dateUpdated": "2026-11-11T13:58:59.979Z" }, "containers": { "cna": { @@ -54,8 +54,16 @@ "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "gstreamer1-plugins-good", "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.26.7-10.el10_3.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], "cpes": [ - "cpe:/a:redhat:enterprise_linux:10" + "cpe:/o:redhat:enterprise_linux:10.3" ] }, { @@ -110,6 +118,14 @@ } ], "references": [ + { + "url": "https://access.redhat.com/errata/RHSA-2026:98644", + "name": "RHSA-2026:98644", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-121629", "tags": [ @@ -167,7 +183,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-09T11:35:18.991Z" + "dateUpdated": "2026-11-11T13:58:59.979Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/121xxx/CVE-2026-121770.json b/data/2026/121xxx/CVE-2026-121770.json index 44852ce030..572463f910 100644 --- a/data/2026/121xxx/CVE-2026-121770.json +++ b/data/2026/121xxx/CVE-2026-121770.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-04T00:24:30.154Z", "datePublished": "2026-11-11T11:48:40.016Z", - "dateUpdated": "2026-11-11T11:49:41.916Z" + "dateUpdated": "2026-11-11T13:43:13.772Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:43:03.338256Z", + "id": "CVE-2026-121770", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:43:13.772Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/121xxx/CVE-2026-121773.json b/data/2026/121xxx/CVE-2026-121773.json index 6706f640cb..52a250f150 100644 --- a/data/2026/121xxx/CVE-2026-121773.json +++ b/data/2026/121xxx/CVE-2026-121773.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-04T00:24:30.154Z", "datePublished": "2026-11-11T11:47:14.131Z", - "dateUpdated": "2026-11-11T11:47:15.324Z" + "dateUpdated": "2026-11-11T13:45:32.169Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:11.379770Z", + "id": "CVE-2026-121773", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:45:32.169Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123040.json b/data/2026/123xxx/CVE-2026-123040.json new file mode 100644 index 0000000000..9b06806074 --- /dev/null +++ b/data/2026/123xxx/CVE-2026-123040.json @@ -0,0 +1,139 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-123040", + "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", + "state": "PUBLISHED", + "assignerShortName": "Kaspersky", + "dateReserved": "2026-11-05T07:33:05.167Z", + "datePublished": "2026-11-11T14:00:01.991Z", + "dateUpdated": "2026-11-11T14:00:01.991Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", + "shortName": "Kaspersky", + "dateUpdated": "2026-11-11T14:00:01.991Z" + }, + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "cweId": "CWE-276", + "description": "CWE-276: Incorrect Default Permissions", + "type": "CWE" + } + ] + } + ], + "affected": [ + { + "vendor": "TrueConf", + "product": "TrueConf Server", + "platforms": [ + "Linux" + ], + "versions": [ + { + "version": "4.7.2", + "status": "affected", + "lessThan": "5.5.6", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected" + } + ], + "descriptions": [ + { + "lang": "en", + "value": "An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root." + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV4_0": { + "baseScore": 8.5, + "baseSeverity": "HIGH", + "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", + "version": "4.0" + }, + "cvssV3_1": { + "version": "3.1", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 7.8, + "baseSeverity": "HIGH", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + } + ], + "solutions": [ + { + "lang": "en", + "value": "Update TrueConf Server (Linux) to versions 5.5.6 or newer." + } + ], + "workarounds": [ + { + "lang": "en", + "value": "Perform a full check with anti-virus software that has up-to-date anti-virus databases and software modules." + } + ], + "timeline": [ + { + "time": "2026-08-11T00:00:00.000Z", + "lang": "en", + "value": "Issue reported by Kaspersky ICS CERT to TrueConf" + }, + { + "time": "2026-08-18T00:00:00.000Z", + "lang": "en", + "value": "Issue confirmed by TrueConf" + }, + { + "time": "2026-11-10T00:00:00.000Z", + "lang": "en", + "value": "Advisory published by Kaspersky ICS CERT" + } + ], + "credits": [ + { + "lang": "en", + "value": "Vyacheslav Kopeytsev from Kaspersky ICS CERT", + "type": "finder" + }, + { + "lang": "en", + "value": "Grigory Sablin from Kaspersky GERT", + "type": "finder" + } + ], + "references": [ + { + "url": "https://ics-cert.kaspersky.com/advisories/2026/11/10/trueconf-server-linux-incorrect-default-permissions/", + "name": "KLCERT-26-059: TrueConf Server (Linux). Incorrect Default Permissions", + "tags": [ + "third-party-advisory" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123473.json b/data/2026/123xxx/CVE-2026-123473.json index 625d380311..34f667f97f 100644 --- a/data/2026/123xxx/CVE-2026-123473.json +++ b/data/2026/123xxx/CVE-2026-123473.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-06T00:25:34.012Z", "datePublished": "2026-11-11T11:47:34.378Z", - "dateUpdated": "2026-11-11T11:48:36.406Z" + "dateUpdated": "2026-11-11T13:45:16.530Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:08.092865Z", + "id": "CVE-2026-123473", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:45:16.530Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123478.json b/data/2026/123xxx/CVE-2026-123478.json index d03b4fabc2..705d791643 100644 --- a/data/2026/123xxx/CVE-2026-123478.json +++ b/data/2026/123xxx/CVE-2026-123478.json @@ -8,14 +8,14 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-06T00:25:34.013Z", "datePublished": "2026-11-11T11:00:21.338Z", - "dateUpdated": "2026-11-11T11:00:21.338Z" + "dateUpdated": "2026-11-11T13:47:25.725Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", - "dateUpdated": "2026-11-11T11:00:21.338Z" + "dateUpdated": "2026-11-11T13:30:15.870Z" }, "title": "WordPress AI Engine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability", "datePublic": "2026-11-09T10:10:30.000Z", @@ -132,8 +132,43 @@ } ], "tags": [ + "x_known-exploited-vulnerability", "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:40.290845Z", + "id": "CVE-2026-123478", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:47:25.725Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/123xxx/CVE-2026-123480.json b/data/2026/123xxx/CVE-2026-123480.json index 31c5c0dd41..90cfed7ece 100644 --- a/data/2026/123xxx/CVE-2026-123480.json +++ b/data/2026/123xxx/CVE-2026-123480.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-06T00:25:34.013Z", "datePublished": "2026-11-11T12:41:33.649Z", - "dateUpdated": "2026-11-11T12:42:33.630Z" + "dateUpdated": "2026-11-11T13:42:47.382Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:36.102532Z", + "id": "CVE-2026-123480", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:42:47.382Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124250.json b/data/2026/124xxx/CVE-2026-124250.json index cf5c9d3a6b..17d8c319b0 100644 --- a/data/2026/124xxx/CVE-2026-124250.json +++ b/data/2026/124xxx/CVE-2026-124250.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-07T00:30:09.634Z", "datePublished": "2026-11-11T10:00:10.232Z", - "dateUpdated": "2026-11-11T10:00:10.232Z" + "dateUpdated": "2026-11-11T13:48:16.365Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:51.627086Z", + "id": "CVE-2026-124250", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:48:16.365Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124253.json b/data/2026/124xxx/CVE-2026-124253.json index 8a8dc81b60..7c5cf4f303 100644 --- a/data/2026/124xxx/CVE-2026-124253.json +++ b/data/2026/124xxx/CVE-2026-124253.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-07T00:30:09.634Z", "datePublished": "2026-11-11T11:00:21.878Z", - "dateUpdated": "2026-11-11T11:00:21.878Z" + "dateUpdated": "2026-11-11T13:47:08.627Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:36.534222Z", + "id": "CVE-2026-124253", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:47:08.627Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124256.json b/data/2026/124xxx/CVE-2026-124256.json index a9c58681cc..e807877136 100644 --- a/data/2026/124xxx/CVE-2026-124256.json +++ b/data/2026/124xxx/CVE-2026-124256.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-07T00:30:09.635Z", "datePublished": "2026-11-11T10:00:11.299Z", - "dateUpdated": "2026-11-11T10:00:11.299Z" + "dateUpdated": "2026-11-11T13:47:42.076Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:44.567571Z", + "id": "CVE-2026-124256", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:47:42.076Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124257.json b/data/2026/124xxx/CVE-2026-124257.json index 023939bd40..b2c82a49fa 100644 --- a/data/2026/124xxx/CVE-2026-124257.json +++ b/data/2026/124xxx/CVE-2026-124257.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-07T00:30:09.635Z", "datePublished": "2026-11-11T10:00:10.763Z", - "dateUpdated": "2026-11-11T10:00:10.763Z" + "dateUpdated": "2026-11-11T13:47:59.651Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:48.346719Z", + "id": "CVE-2026-124257", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:47:59.651Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124263.json b/data/2026/124xxx/CVE-2026-124263.json index f51fb7be65..4186e7a994 100644 --- a/data/2026/124xxx/CVE-2026-124263.json +++ b/data/2026/124xxx/CVE-2026-124263.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-07T00:30:09.635Z", "datePublished": "2026-11-11T12:38:14.639Z", - "dateUpdated": "2026-11-11T12:39:14.967Z" + "dateUpdated": "2026-11-11T13:41:25.754Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:41:13.618285Z", + "id": "CVE-2026-124263", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:41:25.754Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124411.json b/data/2026/124xxx/CVE-2026-124411.json index e320f7dc73..25ca2cee60 100644 --- a/data/2026/124xxx/CVE-2026-124411.json +++ b/data/2026/124xxx/CVE-2026-124411.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-08T00:26:41.330Z", "datePublished": "2026-11-11T12:09:07.149Z", - "dateUpdated": "2026-11-11T12:10:08.836Z" + "dateUpdated": "2026-11-11T13:44:26.951Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:56.630455Z", + "id": "CVE-2026-124411", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:44:26.951Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/124xxx/CVE-2026-124752.json b/data/2026/124xxx/CVE-2026-124752.json index f5238d6175..28b0e8fe4d 100644 --- a/data/2026/124xxx/CVE-2026-124752.json +++ b/data/2026/124xxx/CVE-2026-124752.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-09T11:58:42.882Z", "datePublished": "2026-11-11T11:46:54.089Z", - "dateUpdated": "2026-11-11T11:47:53.541Z" + "dateUpdated": "2026-11-11T13:45:47.923Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:14.790284Z", + "id": "CVE-2026-124752", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:45:47.923Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125045.json b/data/2026/125xxx/CVE-2026-125045.json index 78ebe14e21..6faec7a99d 100644 --- a/data/2026/125xxx/CVE-2026-125045.json +++ b/data/2026/125xxx/CVE-2026-125045.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-09T16:21:06.462Z", "datePublished": "2026-11-11T12:34:30.029Z", - "dateUpdated": "2026-11-11T12:35:31.243Z" + "dateUpdated": "2026-11-11T13:44:11.544Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:53.178871Z", + "id": "CVE-2026-125045", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:44:11.544Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125433.json b/data/2026/125xxx/CVE-2026-125433.json index 044a8f7108..8815c1cfce 100644 --- a/data/2026/125xxx/CVE-2026-125433.json +++ b/data/2026/125xxx/CVE-2026-125433.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.520Z", "datePublished": "2026-11-11T12:39:14.195Z", - "dateUpdated": "2026-11-11T12:39:15.528Z" + "dateUpdated": "2026-11-11T13:43:22.830Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:42.772012Z", + "id": "CVE-2026-125433", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:43:22.830Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125445.json b/data/2026/125xxx/CVE-2026-125445.json index 15b01fa004..148cd59a82 100644 --- a/data/2026/125xxx/CVE-2026-125445.json +++ b/data/2026/125xxx/CVE-2026-125445.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.521Z", "datePublished": "2026-11-11T12:11:19.290Z", - "dateUpdated": "2026-11-11T12:11:23.455Z" + "dateUpdated": "2026-11-11T13:42:56.420Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:42:48.174821Z", + "id": "CVE-2026-125445", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:42:56.420Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125446.json b/data/2026/125xxx/CVE-2026-125446.json index 3b508fa951..cac702f1de 100644 --- a/data/2026/125xxx/CVE-2026-125446.json +++ b/data/2026/125xxx/CVE-2026-125446.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.522Z", "datePublished": "2026-11-11T12:12:13.426Z", - "dateUpdated": "2026-11-11T12:12:13.920Z" + "dateUpdated": "2026-11-11T13:49:27.147Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125446", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:47:28.282890Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:27.147Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125450.json b/data/2026/125xxx/CVE-2026-125450.json index 21cedc3b68..cc50ba0435 100644 --- a/data/2026/125xxx/CVE-2026-125450.json +++ b/data/2026/125xxx/CVE-2026-125450.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.522Z", "datePublished": "2026-11-11T12:35:19.626Z", - "dateUpdated": "2026-11-11T12:35:19.626Z" + "dateUpdated": "2026-11-11T13:43:38.319Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:46.132329Z", + "id": "CVE-2026-125450", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:43:38.319Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125451.json b/data/2026/125xxx/CVE-2026-125451.json index 67d82b7d41..ad8735b216 100644 --- a/data/2026/125xxx/CVE-2026-125451.json +++ b/data/2026/125xxx/CVE-2026-125451.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.522Z", "datePublished": "2026-11-11T11:38:57.130Z", - "dateUpdated": "2026-11-11T11:39:56.326Z" + "dateUpdated": "2026-11-11T13:46:18.931Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:25.686775Z", + "id": "CVE-2026-125451", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:46:18.931Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125454.json b/data/2026/125xxx/CVE-2026-125454.json index 97a17551ed..33b213449f 100644 --- a/data/2026/125xxx/CVE-2026-125454.json +++ b/data/2026/125xxx/CVE-2026-125454.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.522Z", "datePublished": "2026-11-11T12:59:38.477Z", - "dateUpdated": "2026-11-11T13:00:40.199Z" + "dateUpdated": "2026-11-11T13:42:31.161Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:32.912079Z", + "id": "CVE-2026-125454", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:42:31.161Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125455.json b/data/2026/125xxx/CVE-2026-125455.json index bbc530ebcc..aad53138c9 100644 --- a/data/2026/125xxx/CVE-2026-125455.json +++ b/data/2026/125xxx/CVE-2026-125455.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T00:26:46.523Z", "datePublished": "2026-11-11T11:40:12.062Z", - "dateUpdated": "2026-11-11T11:40:15.374Z" + "dateUpdated": "2026-11-11T13:46:03.282Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:18.105610Z", + "id": "CVE-2026-125455", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:46:03.282Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125680.json b/data/2026/125xxx/CVE-2026-125680.json index fe2b914fc6..3901fc960d 100644 --- a/data/2026/125xxx/CVE-2026-125680.json +++ b/data/2026/125xxx/CVE-2026-125680.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T09:51:47.092Z", "datePublished": "2026-11-11T11:57:03.218Z", - "dateUpdated": "2026-11-11T11:58:04.108Z" + "dateUpdated": "2026-11-11T13:44:43.831Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:59.795157Z", + "id": "CVE-2026-125680", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:44:43.831Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125708.json b/data/2026/125xxx/CVE-2026-125708.json index 221ff3b1f5..7af97e6ef8 100644 --- a/data/2026/125xxx/CVE-2026-125708.json +++ b/data/2026/125xxx/CVE-2026-125708.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T10:33:19.136Z", "datePublished": "2026-11-11T13:01:17.688Z", - "dateUpdated": "2026-11-11T13:02:23.291Z" + "dateUpdated": "2026-11-11T13:42:15.014Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:29.472157Z", + "id": "CVE-2026-125708", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:42:15.014Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125743.json b/data/2026/125xxx/CVE-2026-125743.json index 3026c8ab6c..acebac1c1d 100644 --- a/data/2026/125xxx/CVE-2026-125743.json +++ b/data/2026/125xxx/CVE-2026-125743.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:11:45.564Z", "datePublished": "2026-11-11T12:40:02.640Z", - "dateUpdated": "2026-11-11T12:40:03.278Z" + "dateUpdated": "2026-11-11T13:43:05.673Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:39.375662Z", + "id": "CVE-2026-125743", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:43:05.673Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125761.json b/data/2026/125xxx/CVE-2026-125761.json index 16adf003fc..d9b81d00a0 100644 --- a/data/2026/125xxx/CVE-2026-125761.json +++ b/data/2026/125xxx/CVE-2026-125761.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.981Z", "datePublished": "2026-11-11T11:49:26.425Z", - "dateUpdated": "2026-11-11T11:50:27.104Z" + "dateUpdated": "2026-11-11T13:45:01.054Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:04.242879Z", + "id": "CVE-2026-125761", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:45:01.054Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125762.json b/data/2026/125xxx/CVE-2026-125762.json index 3aff603e6b..3a7e28f574 100644 --- a/data/2026/125xxx/CVE-2026-125762.json +++ b/data/2026/125xxx/CVE-2026-125762.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.981Z", "datePublished": "2026-11-11T12:34:54.965Z", - "dateUpdated": "2026-11-11T12:35:55.754Z" + "dateUpdated": "2026-11-11T13:43:54.529Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:38:49.483035Z", + "id": "CVE-2026-125762", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:43:54.529Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125781.json b/data/2026/125xxx/CVE-2026-125781.json index 0a3183bf14..9dc36a8610 100644 --- a/data/2026/125xxx/CVE-2026-125781.json +++ b/data/2026/125xxx/CVE-2026-125781.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.983Z", "datePublished": "2026-11-11T11:35:59.280Z", - "dateUpdated": "2026-11-11T11:37:00.658Z" + "dateUpdated": "2026-11-11T13:46:34.367Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:29.082557Z", + "id": "CVE-2026-125781", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:46:34.367Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125784.json b/data/2026/125xxx/CVE-2026-125784.json index ba3225b710..a58c5616d0 100644 --- a/data/2026/125xxx/CVE-2026-125784.json +++ b/data/2026/125xxx/CVE-2026-125784.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.984Z", "datePublished": "2026-11-11T11:37:28.145Z", - "dateUpdated": "2026-11-11T11:38:29.095Z" + "dateUpdated": "2026-11-11T13:49:27.309Z" }, "containers": { "cna": { @@ -134,6 +134,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125784", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:47:31.891089Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:27.309Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125838.json b/data/2026/125xxx/CVE-2026-125838.json new file mode 100644 index 0000000000..2a00173404 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125838.json @@ -0,0 +1,120 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125838", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:47:25.031Z", + "dateUpdated": "2026-11-11T13:47:25.465Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:47:25.465Z" + }, + "title": "WordPress Quality theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:47:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.

This issue affects Quality: from n/a through 3.3.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Quality", + "packageName": "quality", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "3.3" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/quality/vulnerability/wordpress-quality-theme-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + } + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125839.json b/data/2026/125xxx/CVE-2026-125839.json new file mode 100644 index 0000000000..278ffb3ec2 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125839.json @@ -0,0 +1,120 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125839", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:46:29.120Z", + "dateUpdated": "2026-11-11T13:46:29.522Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:46:29.522Z" + }, + "title": "WordPress ElitePress theme <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:46:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.

This issue affects ElitePress: from n/a through 3.2.1.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "ElitePress", + "packageName": "elitepress", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "3.2.1" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/elitepress/vulnerability/wordpress-elitepress-theme-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + } + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125840.json b/data/2026/125xxx/CVE-2026-125840.json new file mode 100644 index 0000000000..798b724f03 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125840.json @@ -0,0 +1,120 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125840", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:44:59.478Z", + "dateUpdated": "2026-11-11T13:46:00.406Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:46:00.406Z" + }, + "title": "WordPress Rambo theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:44:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.This issue affects Rambo: from n/a through 3.0.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.

This issue affects Rambo: from n/a through 3.0.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Rambo", + "packageName": "rambo", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "3.0" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/rambo/vulnerability/wordpress-rambo-theme-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + } + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125841.json b/data/2026/125xxx/CVE-2026-125841.json new file mode 100644 index 0000000000..322c6efa04 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125841.json @@ -0,0 +1,120 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125841", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:44:01.109Z", + "dateUpdated": "2026-11-11T13:44:07.649Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:44:07.649Z" + }, + "title": "WordPress Heroic theme <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:43:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.

This issue affects Heroic: from n/a through 1.4.2.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Heroic", + "packageName": "heroic", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "1.4.2" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/heroic/vulnerability/wordpress-heroic-theme-1-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + } + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125842.json b/data/2026/125xxx/CVE-2026-125842.json new file mode 100644 index 0000000000..bb034912e3 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125842.json @@ -0,0 +1,120 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125842", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:39:46.424Z", + "dateUpdated": "2026-11-11T13:39:46.944Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:39:46.944Z" + }, + "title": "WordPress Wallstreet Agency theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:39:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.This issue affects Wallstreet Agency: from n/a through 1.3.4.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.

This issue affects Wallstreet Agency: from n/a through 1.3.4.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Wallstreet Agency", + "packageName": "wallstreet-agency", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "1.3.4" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/wallstreet-agency/vulnerability/wordpress-wallstreet-agency-theme-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + } + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125843.json b/data/2026/125xxx/CVE-2026-125843.json new file mode 100644 index 0000000000..79ff9b704c --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125843.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125843", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:26:16.081Z", + "dateUpdated": "2026-11-11T13:46:47.119Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:27:17.383Z" + }, + "title": "WordPress Spasalon theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:25:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.

This issue affects Spasalon: from n/a through 3.0.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Spasalon", + "packageName": "spasalon", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "3.0" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/spasalon/vulnerability/wordpress-spasalon-theme-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:46:40.531734Z", + "id": "CVE-2026-125843", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:46:47.119Z" + } + } + ] + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125844.json b/data/2026/125xxx/CVE-2026-125844.json new file mode 100644 index 0000000000..45a7beebc3 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125844.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125844", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:25:35.957Z", + "dateUpdated": "2026-11-11T13:49:26.123Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:26:35.307Z" + }, + "title": "WordPress vice theme <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:25:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.

This issue affects vice: from n/a through 1.4.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "vice", + "packageName": "vice", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "1.4" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/vice/vulnerability/wordpress-vice-theme-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125844", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:46:35.816527Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:26.123Z" + } + } + ] + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125845.json b/data/2026/125xxx/CVE-2026-125845.json new file mode 100644 index 0000000000..e824543b64 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125845.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125845", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:24:44.320Z", + "dateUpdated": "2026-11-11T13:49:26.275Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:25:45.232Z" + }, + "title": "WordPress vdequator theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:24:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.This issue affects vdequator: from n/a through 1.2.7.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.

This issue affects vdequator: from n/a through 1.2.7.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "vdequator", + "packageName": "vdequator", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "1.2.7" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/vdequator/vulnerability/wordpress-vdequator-theme-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125845", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:46:39.237571Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:26.275Z" + } + } + ] + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125846.json b/data/2026/125xxx/CVE-2026-125846.json new file mode 100644 index 0000000000..6f35385603 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125846.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125846", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:23:57.338Z", + "dateUpdated": "2026-11-11T13:49:26.433Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:24:58.995Z" + }, + "title": "WordPress Mazino theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:23:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.

This issue affects Mazino: from n/a through 1.1.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Mazino", + "packageName": "mazino", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "1.1" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125846", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:46:44.122760Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:26.433Z" + } + } + ] + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125847.json b/data/2026/125xxx/CVE-2026-125847.json new file mode 100644 index 0000000000..60a0cca164 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125847.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125847", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.991Z", + "datePublished": "2026-11-11T13:23:23.134Z", + "dateUpdated": "2026-11-11T13:47:56.953Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:24:25.334Z" + }, + "title": "WordPress vdperanto theme <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:23:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.

This issue affects vdperanto: from n/a through 2.2.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "vdperanto", + "packageName": "vdperanto", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "2.2" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/vdperanto/vulnerability/wordpress-vdperanto-theme-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:47:50.577154Z", + "id": "CVE-2026-125847", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:47:56.953Z" + } + } + ] + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125848.json b/data/2026/125xxx/CVE-2026-125848.json new file mode 100644 index 0000000000..413951a001 --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125848.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125848", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.992Z", + "datePublished": "2026-11-11T13:22:44.427Z", + "dateUpdated": "2026-11-11T13:49:26.586Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:23:44.575Z" + }, + "title": "WordPress Leo theme <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:22:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.

This issue affects Leo: from n/a through 1.7.4.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Leo", + "packageName": "leo", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "1.7.4" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/leo/vulnerability/wordpress-leo-theme-1-7-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125848", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:47:16.556412Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:26.586Z" + } + } + ] + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125849.json b/data/2026/125xxx/CVE-2026-125849.json new file mode 100644 index 0000000000..c7c1700f6e --- /dev/null +++ b/data/2026/125xxx/CVE-2026-125849.json @@ -0,0 +1,154 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-125849", + "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "state": "PUBLISHED", + "assignerShortName": "Patchstack", + "dateReserved": "2026-11-10T12:37:30.992Z", + "datePublished": "2026-11-11T13:21:29.942Z", + "dateUpdated": "2026-11-11T13:49:26.773Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", + "shortName": "Patchstack", + "dateUpdated": "2026-11-11T13:21:30.312Z" + }, + "title": "WordPress Shk Corporate theme <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability", + "datePublic": "2026-11-11T13:21:00.000Z", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3.", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.

This issue affects Shk Corporate: from n/a through 2.4.3.

" + } + ] + } + ], + "affected": [ + { + "vendor": "webriti", + "product": "Shk Corporate", + "packageName": "shk-corporate", + "collectionURL": "https://wordpress.org/plugins", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "0", + "versionType": "custom", + "status": "affected", + "lessThanOrEqual": "2.4.3" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/wordpress/theme/shk-corporate/vulnerability/wordpress-shk-corporate-theme-2-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "tags": [ + "vdb-entry" + ] + } + ], + "credits": [ + { + "lang": "en", + "value": "beopseong.kim | Patchstack Bug Bounty Program", + "type": "finder" + } + ], + "metrics": [ + { + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ], + "cvssV3_1": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-352", + "description": "Cross-Site Request Forgery (CSRF)", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "impacts": [ + { + "capecId": "CAPEC-62", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Request Forgery" + } + ] + } + ], + "tags": [ + "x_open-source" + ] + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125849", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:47:20.730736Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:26.773Z" + } + } + ] + } +} \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125850.json b/data/2026/125xxx/CVE-2026-125850.json index c900cf0fe4..ed6338a1fa 100644 --- a/data/2026/125xxx/CVE-2026-125850.json +++ b/data/2026/125xxx/CVE-2026-125850.json @@ -8,7 +8,7 @@ "assignerShortName": "Patchstack", "dateReserved": "2026-11-10T12:37:30.992Z", "datePublished": "2026-11-11T13:16:11.697Z", - "dateUpdated": "2026-11-11T13:16:12.172Z" + "dateUpdated": "2026-11-11T13:49:26.962Z" }, "containers": { "cna": { @@ -115,6 +115,40 @@ "tags": [ "x_open-source" ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "id": "CVE-2026-125850", + "role": "CISA Coordinator", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "version": "2.0.3", + "timestamp": "2026-11-11T13:47:24.720596Z" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:26.962Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/125xxx/CVE-2026-125879.json b/data/2026/125xxx/CVE-2026-125879.json index f375ce77ce..959ae104b7 100644 --- a/data/2026/125xxx/CVE-2026-125879.json +++ b/data/2026/125xxx/CVE-2026-125879.json @@ -8,7 +8,7 @@ "assignerShortName": "N-able", "dateReserved": "2026-11-10T12:55:11.705Z", "datePublished": "2026-11-10T21:23:18.540Z", - "dateUpdated": "2026-11-10T21:23:18.540Z" + "dateUpdated": "2026-11-11T13:59:08.131Z" }, "containers": { "cna": { @@ -118,6 +118,40 @@ "x_generator": { "engine": "Vulnogram 1.0.5" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:58:59.410493Z", + "id": "CVE-2026-125879", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:59:08.131Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/12xxx/CVE-2026-12424.json b/data/2026/12xxx/CVE-2026-12424.json index 216e8261e0..01da0bc9b9 100644 --- a/data/2026/12xxx/CVE-2026-12424.json +++ b/data/2026/12xxx/CVE-2026-12424.json @@ -8,7 +8,7 @@ "assignerShortName": "Wordfence", "dateReserved": "2026-06-16T16:57:45.442Z", "datePublished": "2026-11-11T07:26:40.463Z", - "dateUpdated": "2026-11-11T07:26:40.463Z" + "dateUpdated": "2026-11-11T13:48:48.121Z" }, "containers": { "cna": { @@ -83,6 +83,40 @@ "value": "Disclosed" } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:58.166509Z", + "id": "CVE-2026-12424", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:48:48.121Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/12xxx/CVE-2026-12427.json b/data/2026/12xxx/CVE-2026-12427.json index 7e31293f47..bea53c63d6 100644 --- a/data/2026/12xxx/CVE-2026-12427.json +++ b/data/2026/12xxx/CVE-2026-12427.json @@ -8,7 +8,7 @@ "assignerShortName": "Wordfence", "dateReserved": "2026-06-16T17:06:18.591Z", "datePublished": "2026-11-11T07:26:40.857Z", - "dateUpdated": "2026-11-11T07:26:40.857Z" + "dateUpdated": "2026-11-11T13:48:32.553Z" }, "containers": { "cna": { @@ -83,6 +83,40 @@ "value": "Disclosed" } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:39:54.881215Z", + "id": "CVE-2026-12427", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:48:32.553Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/15xxx/CVE-2026-15785.json b/data/2026/15xxx/CVE-2026-15785.json index 537608ce49..bc75bd3311 100644 --- a/data/2026/15xxx/CVE-2026-15785.json +++ b/data/2026/15xxx/CVE-2026-15785.json @@ -8,7 +8,7 @@ "assignerShortName": "Wordfence", "dateReserved": "2026-07-14T19:10:47.225Z", "datePublished": "2026-11-11T07:26:39.942Z", - "dateUpdated": "2026-11-11T07:26:39.942Z" + "dateUpdated": "2026-11-11T13:49:04.324Z" }, "containers": { "cna": { @@ -107,6 +107,40 @@ "value": "Disclosed" } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:40:02.955884Z", + "id": "CVE-2026-15785", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:04.324Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/32xxx/CVE-2026-32146.json b/data/2026/32xxx/CVE-2026-32146.json index 8369673850..842b108a5b 100644 --- a/data/2026/32xxx/CVE-2026-32146.json +++ b/data/2026/32xxx/CVE-2026-32146.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-03-10T22:37:29.213Z", "datePublished": "2026-04-11T12:59:22.911Z", - "dateUpdated": "2026-11-10T17:40:31.314Z" + "dateUpdated": "2026-11-11T14:13:44.294Z" }, "containers": { "cna": { @@ -306,6 +306,7 @@ "value": "Jonatan Männchen / EEF" } ], + "datePublic": "2026-04-11T12:59:22.000Z", "descriptions": [ { "lang": "en", @@ -393,7 +394,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-11-10T17:40:31.314Z" + "dateUpdated": "2026-11-11T14:13:44.294Z" }, "references": [ { diff --git a/data/2026/48xxx/CVE-2026-48859.json b/data/2026/48xxx/CVE-2026-48859.json index e9db896d5f..1e8ac06e2a 100644 --- a/data/2026/48xxx/CVE-2026-48859.json +++ b/data/2026/48xxx/CVE-2026-48859.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-05-25T20:44:10.697Z", "datePublished": "2026-06-10T14:35:43.553Z", - "dateUpdated": "2026-09-08T01:05:48.773Z" + "dateUpdated": "2026-11-11T13:57:17.599Z" }, "containers": { "cna": { @@ -57,7 +57,7 @@ "ssh_options" ], "packageName": "ssh", - "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", + "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/ssh_auth.erl", @@ -256,7 +256,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:05:48.773Z" + "dateUpdated": "2026-11-11T13:57:17.599Z" }, "references": [ { @@ -267,24 +267,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-3w6p-vwhf-wvp4" }, { + "name": "EEF CNA record for CVE-2026-48859", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-48859.html" }, { + "name": "OSV record EEF-CVE-2026-48859", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48859" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit 032d1bc in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/032d1bc9491a3975c68faf9bc7776115d6ae3005" + }, + { + "name": "Fix commit c342092 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/49xxx/CVE-2026-49236.json b/data/2026/49xxx/CVE-2026-49236.json new file mode 100644 index 0000000000..682b6c8d69 --- /dev/null +++ b/data/2026/49xxx/CVE-2026-49236.json @@ -0,0 +1,105 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.2", + "cveMetadata": { + "cveId": "CVE-2026-49236", + "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", + "state": "PUBLISHED", + "assignerShortName": "apache", + "dateReserved": "2026-05-28T11:34:15.177Z", + "datePublished": "2026-11-11T13:23:38.353Z", + "dateUpdated": "2026-11-11T13:23:38.353Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", + "shortName": "apache", + "dateUpdated": "2026-11-11T13:23:38.353Z" + }, + "title": "Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks", + "problemTypes": [ + { + "descriptions": [ + { + "description": "CWE-918 Server-Side Request Forgery (SSRF)", + "lang": "en", + "cweId": "CWE-918", + "type": "CWE" + } + ] + } + ], + "source": { + "defect": [ + "BATIK-1394" + ], + "discovery": "UNKNOWN" + }, + "affected": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache XML Graphics Batik", + "packageURL": "pkg:maven/org.apache.xmlgraphics/batik-bridge", + "versions": [ + { + "status": "affected", + "version": "0", + "lessThanOrEqual": "1.19.0", + "versionType": "semver" + } + ], + "defaultStatus": "unaffected", + "collectionURL": "https://repo.maven.apache.org/maven2", + "packageName": "org.apache.xmlgraphics:batik-bridge" + } + ], + "descriptions": [ + { + "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.", + "lang": "en", + "supportingMedia": [ + { + "type": "text/html", + "base64": false, + "value": "

Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

" + } + ] + } + ], + "references": [ + { + "url": "https://issues.apache.org/jira/browse/BATIK-1394", + "tags": [ + "issue-tracking" + ] + }, + { + "url": "https://lists.apache.org/thread.html/xpysqx09ycpj23qk6b10k87pssqx0dk2", + "tags": [ + "vendor-advisory" + ] + } + ], + "metrics": [ + { + "other": { + "type": "Textual description of severity", + "content": { + "text": "moderate" + } + }, + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ] + } + ], + "x_generator": { + "engine": "Vulnogram 0.2.0" + } + } + } +} \ No newline at end of file diff --git a/data/2026/55xxx/CVE-2026-55951.json b/data/2026/55xxx/CVE-2026-55951.json index 053fa09706..97014f49a1 100644 --- a/data/2026/55xxx/CVE-2026-55951.json +++ b/data/2026/55xxx/CVE-2026-55951.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-06-17T17:55:15.685Z", "datePublished": "2026-09-01T14:37:02.650Z", - "dateUpdated": "2026-09-08T01:06:43.872Z" + "dateUpdated": "2026-11-11T13:56:27.286Z" }, "containers": { "cna": { @@ -17,7 +17,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpc_response", "httpc_handler", @@ -45,28 +45,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -74,36 +70,32 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -112,7 +104,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpc_response", "httpc_handler", @@ -155,6 +147,18 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa", + "versionType": "git" } ] } @@ -203,15 +207,15 @@ { "base64": false, "type": "text/html", - "value": "

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).

\n

A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.

\n

Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).

\n

A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.

\n

Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "The Erlang/OTP `httpc` HTTP client does not enforce a limit on the total size of response headers received from a server. The `max_header_size` option defaults to `nolimit`, and `httpc_response:parse_headers/6` accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).\n\nA malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.\n\nAny application using `httpc:request/4,5` to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "The Erlang/OTP `httpc` HTTP client does not enforce a limit on the total size of response headers received from a server. The `max_header_size` option defaults to `nolimit`, and `httpc_response:parse_headers/6` accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).\n\nA malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.\n\nAny application using `httpc:request/4,5` to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).\n\nA malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.\n\nAny application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).\n\nA malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.\n\nAny application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -274,7 +278,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:06:43.872Z" + "dateUpdated": "2026-11-11T13:56:27.286Z" }, "references": [ { @@ -284,30 +288,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-f9fw-mg7q-4g3x" }, { + "name": "EEF CNA record for CVE-2026-55951", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-55951.html" }, { + "name": "OSV record EEF-CVE-2026-55951", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55951" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Fix commit aba0fe8 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d" }, { + "name": "Fix commit e3be1cf in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/59xxx/CVE-2026-59696.json b/data/2026/59xxx/CVE-2026-59696.json index 6a73f7157f..09340f6f9a 100644 --- a/data/2026/59xxx/CVE-2026-59696.json +++ b/data/2026/59xxx/CVE-2026-59696.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-07-06T14:05:47.003Z", "datePublished": "2026-09-01T14:37:33.697Z", - "dateUpdated": "2026-09-08T01:07:47.936Z" + "dateUpdated": "2026-11-11T13:55:48.756Z" }, "containers": { "cna": { @@ -38,22 +38,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "21.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -66,7 +68,7 @@ "uri_string" ], "packageName": "stdlib", - "packageURL": "pkg:otp/stdlib", + "packageURL": "pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/uri_string.erl" @@ -83,22 +85,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "6.2.2.5", + "changes": [ + { + "at": "6.2.2.5", + "status": "unaffected" + }, + { + "at": "7.3.0.2", + "status": "unaffected" + }, + { + "at": "8.0.4", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "3.5", "versionType": "otp" - }, - { - "lessThan": "7.3.0.2", - "status": "affected", - "version": "7.0", - "versionType": "otp" - }, - { - "lessThan": "8.0.4", - "status": "affected", - "version": "8.0", - "versionType": "otp" } ] }, @@ -232,15 +236,15 @@ { "base64": false, "type": "text/html", - "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.

\n

uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

\n

This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.

" + "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.

\n

uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

\n

This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, 7.3.0.2, and 8.0.4.

" }, { "base64": false, "type": "text/markdown", - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.\n\n`uri_string:get_port/1` passes the port substring to `binary_to_integer/1` with no length bound, catching only `error:badarg`, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in `uri_string:parse/1`, including the host, registered-name, and IPv4 and IPv6 forms. `parse/1` is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.\n\n`uri_string:get_port/1` passes the port substring to `binary_to_integer/1` with no length bound, catching only `error:badarg`, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in `uri_string:parse/1`, including the host, registered-name, and IPv4 and IPv6 forms. `parse/1` is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 21.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, 7.3.0.2, and 8.0.4." } ], - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.\n\nuri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.\n\nuri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 21.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, 7.3.0.2, and 8.0.4." } ], "impacts": [ @@ -303,7 +307,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:07:47.936Z" + "dateUpdated": "2026-11-11T13:55:48.756Z" }, "references": [ { @@ -313,30 +317,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2" }, { + "name": "EEF CNA record for CVE-2026-59696", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-59696.html" }, { + "name": "OSV record EEF-CVE-2026-59696", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59696" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit 29a9dd0 in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/29a9dd0e17a97a3e6e46f0d08c6ba8f31db33f5e" + }, + { + "name": "Fix commit aba0fe8 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d" }, { + "name": "Fix commit e3be1cf in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/65xxx/CVE-2026-65634.json b/data/2026/65xxx/CVE-2026-65634.json index ab7e5501db..999b43e69d 100644 --- a/data/2026/65xxx/CVE-2026-65634.json +++ b/data/2026/65xxx/CVE-2026-65634.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-07-22T13:58:26.233Z", "datePublished": "2026-09-22T08:49:24.743Z", - "dateUpdated": "2026-09-24T20:06:38.007Z" + "dateUpdated": "2026-11-11T13:54:59.321Z" }, "containers": { "cna": { @@ -77,7 +77,7 @@ "asn1rtt_jer" ], "packageName": "asn1", - "packageURL": "pkg:otp/asn1", + "packageURL": "pkg:otp/asn1?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/asn1rtt_ber.erl", @@ -294,7 +294,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-24T20:06:38.007Z" + "dateUpdated": "2026-11-11T13:54:59.321Z" }, "references": [ { diff --git a/data/2026/66xxx/CVE-2026-66357.json b/data/2026/66xxx/CVE-2026-66357.json index f9775b1462..4d2c92f1af 100644 --- a/data/2026/66xxx/CVE-2026-66357.json +++ b/data/2026/66xxx/CVE-2026-66357.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T20:00:02.207Z", "datePublished": "2026-09-01T14:40:50.526Z", - "dateUpdated": "2026-09-08T01:08:00.943Z" + "dateUpdated": "2026-11-11T13:54:07.717Z" }, "containers": { "cna": { @@ -17,35 +17,31 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -53,36 +49,32 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -91,7 +83,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", @@ -117,6 +109,24 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "220d618d2479a7180b4a06d0c5aacfaa4af4a85b", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "273d8958de38ff2a7fe0c5dcc5b6bfe6f65717f3", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "e640d599287d2eba919e6f13b91f042d7dbe6ff4", + "versionType": "git" } ] } @@ -170,15 +180,15 @@ { "base64": false, "type": "text/html", - "value": "

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -231,7 +241,7 @@ "descriptions": [ { "cweId": "CWE-444", - "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", + "description": "CWE-444 Inconsistent Interpretation of HTTP Requests", "lang": "en", "type": "CWE" } @@ -241,7 +251,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:08:00.943Z" + "dateUpdated": "2026-11-11T13:54:07.717Z" }, "references": [ { @@ -251,30 +261,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-qh2f-33hj-37qf" }, { + "name": "EEF CNA record for CVE-2026-66357", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-66357.html" }, { + "name": "OSV record EEF-CVE-2026-66357", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66357" }, { + "name": "Erlang/OTP version ordering", + "tags": [ + "x_version-scheme" + ], + "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" + }, + { + "name": "Fix commit 220d618 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/220d618d2479a7180b4a06d0c5aacfaa4af4a85b" }, { + "name": "Fix commit 273d895 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/273d8958de38ff2a7fe0c5dcc5b6bfe6f65717f3" }, { + "name": "Fix commit e640d59 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/66xxx/CVE-2026-66835.json b/data/2026/66xxx/CVE-2026-66835.json index a368acbc13..4f15d41a55 100644 --- a/data/2026/66xxx/CVE-2026-66835.json +++ b/data/2026/66xxx/CVE-2026-66835.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T12:00:02.063Z", "datePublished": "2026-09-01T14:49:47.805Z", - "dateUpdated": "2026-09-08T01:08:16.964Z" + "dateUpdated": "2026-11-11T13:53:23.150Z" }, "containers": { "cna": { @@ -17,7 +17,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "mod_auth", "mod_alias", @@ -45,28 +45,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -74,14 +70,14 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "mod_auth", "mod_alias", "httpd_request" ], "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/http_server/mod_auth.erl", @@ -103,28 +99,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -133,7 +125,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "mod_auth", "mod_alias", @@ -180,6 +172,24 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "d8878dec0ececc2eab18e47bb18b472f224ca633", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "9641944a2efbf55bea760f8ff7ba777fe3a0961c", + "versionType": "git" } ] } @@ -261,15 +271,15 @@ { "base64": false, "type": "text/html", - "value": "

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.

\n

httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.

\n

httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a `mod_auth` protected directory by prefixing the request path with an extra slash.\n\n`httpd_request:validate_uri/1` normalises the request URI with `uri_string:normalize/1`, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. `mod_alias:real_name/3` concatenates the document root with that URI, and `mod_auth:secret_path/3` then decides whether the result lies inside a protected `directory` block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while `mod_get` opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in `mod_security`.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a `mod_auth` protected directory by prefixing the request path with an extra slash.\n\n`httpd_request:validate_uri/1` normalises the request URI with `uri_string:normalize/1`, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. `mod_alias:real_name/3` concatenates the document root with that URI, and `mod_auth:secret_path/3` then decides whether the result lies inside a protected `directory` block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while `mod_get` opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in `mod_security`.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.\n\nhttpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.\n\nhttpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -332,7 +342,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:08:16.964Z" + "dateUpdated": "2026-11-11T13:53:23.150Z" }, "references": [ { @@ -343,36 +353,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-r4vv-vc2c-2fw6" }, { + "name": "EEF CNA record for CVE-2026-66835", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-66835.html" }, { + "name": "OSV record EEF-CVE-2026-66835", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66835" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Fix commit bac19eb in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6" }, { + "name": "Fix commit d8878de in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/d8878dec0ececc2eab18e47bb18b472f224ca633" }, { + "name": "Fix commit 9641944 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/68xxx/CVE-2026-68956.json b/data/2026/68xxx/CVE-2026-68956.json index 70efb208df..f3f896849f 100644 --- a/data/2026/68xxx/CVE-2026-68956.json +++ b/data/2026/68xxx/CVE-2026-68956.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T13:30:02.155Z", "datePublished": "2026-09-22T08:49:21.760Z", - "dateUpdated": "2026-09-24T20:07:42.062Z" + "dateUpdated": "2026-11-11T13:52:35.726Z" }, "containers": { "cna": { @@ -74,7 +74,7 @@ "ssh_channel_sup" ], "packageName": "ssh", - "packageURL": "pkg:otp/ssh", + "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/ssh_connection.erl", @@ -309,7 +309,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-24T20:07:42.062Z" + "dateUpdated": "2026-11-11T13:52:35.726Z" }, "references": [ { diff --git a/data/2026/69xxx/CVE-2026-69664.json b/data/2026/69xxx/CVE-2026-69664.json index 6532a3b0a7..aa90448ad2 100644 --- a/data/2026/69xxx/CVE-2026-69664.json +++ b/data/2026/69xxx/CVE-2026-69664.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T10:45:02.808Z", "datePublished": "2026-09-01T14:59:03.512Z", - "dateUpdated": "2026-09-22T09:10:07.550Z" + "dateUpdated": "2026-11-11T13:52:00.601Z" }, "containers": { "cna": { @@ -74,7 +74,7 @@ "httpd_request_handler" ], "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/http_lib/http_chunk.erl", @@ -296,7 +296,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-22T09:10:07.550Z" + "dateUpdated": "2026-11-11T13:52:00.601Z" }, "references": [ { diff --git a/data/2026/70xxx/CVE-2026-70399.json b/data/2026/70xxx/CVE-2026-70399.json index 25258b7fd8..2c75bfab1e 100644 --- a/data/2026/70xxx/CVE-2026-70399.json +++ b/data/2026/70xxx/CVE-2026-70399.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-06T13:00:02.045Z", "datePublished": "2026-09-01T14:33:05.717Z", - "dateUpdated": "2026-09-08T01:08:41.997Z" + "dateUpdated": "2026-11-11T14:07:28.956Z" }, "containers": { "cna": { @@ -38,22 +38,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -66,7 +68,7 @@ "httpd_manager" ], "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/http_server/httpd_manager.erl" @@ -83,22 +85,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -224,15 +228,15 @@ { "base64": false, "type": "text/html", - "value": "

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.

\n

The accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

" + "value": "

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.

\n

The accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2.

" }, { "base64": false, "type": "text/markdown", - "value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The `max_clients` option is documented to default to `150`, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.\n\nThe accept gate in `httpd_manager:handle_new_connection/4` reads the option with `httpd_util:lookup/2`, which returns `undefined` when the key is absent, rather than the three-argument form carrying the `150` default that the neighbouring `get_ustate/2` uses. Erlang term ordering places every integer before every atom, so the `Count =< Max` guard holds for any connection count and the server never returns `{reject, busy}`. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set `max_clients` explicitly are unaffected, because a configured value is applied as intended.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2." + "value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The `max_clients` option is documented to default to `150`, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.\n\nThe accept gate in `httpd_manager:handle_new_connection/4` reads the option with `httpd_util:lookup/2`, which returns `undefined` when the key is absent, rather than the three-argument form carrying the `150` default that the neighbouring `get_ustate/2` uses. Erlang term ordering places every integer before every atom, so the `Count =< Max` guard holds for any connection count and the server never returns `{reject, busy}`. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set `max_clients` explicitly are unaffected, because a configured value is applied as intended.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2." } ], - "value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.\n\nThe accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2." + "value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required.\n\nThe accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2." } ], "impacts": [ @@ -295,7 +299,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:08:41.997Z" + "dateUpdated": "2026-11-11T14:07:28.956Z" }, "references": [ { @@ -306,36 +310,49 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-pwvh-c689-f8q5" }, { + "name": "EEF CNA record for CVE-2026-70399", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-70399.html" }, { + "name": "OSV record EEF-CVE-2026-70399", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-70399" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit d9674f3 in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/d9674f32811cd5bb02b0d6656053b5ee226bc74c" + }, + { + "name": "Fix commit d94a94c in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612" }, { + "name": "Fix commit 6746dc4 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7" }, { + "name": "Fix commit e0050fc in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/70xxx/CVE-2026-70405.json b/data/2026/70xxx/CVE-2026-70405.json index 838c59b11b..52de95a0a0 100644 --- a/data/2026/70xxx/CVE-2026-70405.json +++ b/data/2026/70xxx/CVE-2026-70405.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-06T11:45:02.140Z", "datePublished": "2026-09-01T14:50:34.263Z", - "dateUpdated": "2026-09-08T01:08:55.059Z" + "dateUpdated": "2026-11-11T13:50:14.473Z" }, "containers": { "cna": { @@ -17,7 +17,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "snmp_pdus" ], @@ -41,28 +41,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -70,12 +66,12 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "snmp_pdus" ], "packageName": "snmp", - "packageURL": "pkg:otp/snmp", + "packageURL": "pkg:otp/snmp?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/misc/snmp_pdus.erl" @@ -95,28 +91,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "4.25.1", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "5.18.2.1", + "changes": [ + { + "at": "5.18.2.1", + "status": "unaffected" + }, + { + "at": "5.20.2.2", + "status": "unaffected" + }, + { + "at": "5.20.5", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "4.25.1", "versionType": "otp" - }, - { - "lessThan": "5.20.2.2", - "status": "affected", - "version": "5.19", - "versionType": "otp" - }, - { - "lessThan": "5.20.5", - "status": "affected", - "version": "5.20.3", - "versionType": "otp" } ] }, @@ -125,7 +117,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "snmp_pdus" ], @@ -164,6 +156,18 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa", + "versionType": "git" } ] } @@ -232,15 +236,15 @@ { "base64": false, "type": "text/html", - "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.

\n

snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.

" + "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.

\n

snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, 5.20.2.2, and 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.\n\n`snmp_pdus:dec_integer_notag/1` defaults its size limit to `infinity`, and `do_dec_integer_notag/2` then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant `dec_integer_notag/2` exists but is reached from only one call site, `dec_snmp_version/1`, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by `dec_value/1` all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.\n\n`snmp_pdus:dec_integer_notag/1` defaults its size limit to `infinity`, and `do_dec_integer_notag/2` then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant `dec_integer_notag/2` exists but is reached from only one call site, `dec_snmp_version/1`, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by `dec_value/1` all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, 5.20.2.2, and 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown." } ], - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.\n\nsnmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.\n\nsnmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, 5.20.2.2, and 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown." } ], "impacts": [ @@ -303,7 +307,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:08:55.059Z" + "dateUpdated": "2026-11-11T13:50:14.473Z" }, "references": [ { @@ -314,30 +318,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-q7cq-pfgf-5hr7" }, { + "name": "EEF CNA record for CVE-2026-70405", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-70405.html" }, { + "name": "OSV record EEF-CVE-2026-70405", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-70405" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Fix commit aba0fe8 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d" }, { + "name": "Fix commit e3be1cf in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/70xxx/CVE-2026-70409.json b/data/2026/70xxx/CVE-2026-70409.json index cb44034be5..d717c6972b 100644 --- a/data/2026/70xxx/CVE-2026-70409.json +++ b/data/2026/70xxx/CVE-2026-70409.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-09T16:30:01.576Z", "datePublished": "2026-09-01T14:51:00.770Z", - "dateUpdated": "2026-09-08T01:09:09.018Z" + "dateUpdated": "2026-11-11T13:48:47.878Z" }, "containers": { "cna": { @@ -41,22 +41,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -69,7 +71,7 @@ "eldap" ], "packageName": "eldap", - "packageURL": "pkg:otp/eldap", + "packageURL": "pkg:otp/eldap?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/eldap.erl" @@ -89,22 +91,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "1.2.14.2", + "changes": [ + { + "at": "1.2.14.2", + "status": "unaffected" + }, + { + "at": "1.2.16.1", + "status": "unaffected" + }, + { + "at": "1.3.1", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "1.0.3", "versionType": "otp" - }, - { - "lessThan": "1.2.16.1", - "status": "affected", - "version": "1.2.15", - "versionType": "otp" - }, - { - "lessThan": "1.3.1", - "status": "affected", - "version": "1.3", - "versionType": "otp" } ] }, @@ -221,15 +225,15 @@ { "base64": false, "type": "text/html", - "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits.

\n

eldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1, which eldap never calls itself: referral strings are returned to the caller unparsed.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1.

" + "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits.

\n

eldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1, which eldap never calls itself: referral strings are returned to the caller unparsed.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, 1.2.16.1, and 1.3.1.

" }, { "base64": false, "type": "text/markdown", - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits.\n\n`eldap:parse_port/2` passes the port substring straight to `list_to_integer/1` with no length bound. The surrounding `try ... catch` only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to `eldap:parse_ldap_url/1`, which eldap never calls itself: referral strings are returned to the caller unparsed.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits.\n\n`eldap:parse_port/2` passes the port substring straight to `list_to_integer/1` with no length bound. The surrounding `try ... catch` only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to `eldap:parse_ldap_url/1`, which eldap never calls itself: referral strings are returned to the caller unparsed.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, 1.2.16.1, and 1.3.1." } ], - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits.\n\neldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1, which eldap never calls itself: referral strings are returned to the caller unparsed.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits.\n\neldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1, which eldap never calls itself: referral strings are returned to the caller unparsed.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, 1.2.16.1, and 1.3.1." } ], "impacts": [ @@ -292,7 +296,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:09:09.018Z" + "dateUpdated": "2026-11-11T13:48:47.878Z" }, "references": [ { @@ -303,30 +307,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-9vgh-c8cm-m9p4" }, { + "name": "EEF CNA record for CVE-2026-70409", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-70409.html" }, { + "name": "OSV record EEF-CVE-2026-70409", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-70409" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Introducing commit d8dbf15 in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/d8dbf15de4fa1a08b9a05e7d8e08fdb025fe1dc3" + }, + { + "name": "Fix commit aba0fe8 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d" }, { + "name": "Fix commit e3be1cf in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/71xxx/CVE-2026-71380.json b/data/2026/71xxx/CVE-2026-71380.json index 6f540d4714..5867e0d349 100644 --- a/data/2026/71xxx/CVE-2026-71380.json +++ b/data/2026/71xxx/CVE-2026-71380.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T12:45:01.757Z", "datePublished": "2026-09-01T14:35:31.192Z", - "dateUpdated": "2026-09-08T01:09:23.481Z" + "dateUpdated": "2026-11-11T13:47:09.255Z" }, "containers": { "cna": { @@ -17,7 +17,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpd_request_handler", "httpd_request" @@ -43,28 +43,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -72,13 +68,13 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpd_request_handler", "httpd_request" ], "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/http_server/httpd_request_handler.erl", @@ -99,28 +95,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -129,7 +121,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpd_request_handler", "httpd_request" @@ -160,6 +152,12 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "81b453aac5a006bb8d26405f2bc3cf24e9d7733c", + "versionType": "git" } ] } @@ -213,15 +211,15 @@ { "base64": false, "type": "text/html", - "value": "

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete.

\n

httpd_request_handler:handle_info/2 cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with {active, once} without setting any further timer. httpd_request:whole_body/2 returns such a continuation whenever the bytes received are fewer than the announced Content-Length, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when minimum_bytes_per_second is configured, which it is not by default. Repeating this across connections occupies every worker permitted by max_clients and denies service to legitimate clients at negligible bandwidth cost.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete.

\n

httpd_request_handler:handle_info/2 cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with {active, once} without setting any further timer. httpd_request:whole_body/2 returns such a continuation whenever the bytes received are fewer than the announced Content-Length, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when minimum_bytes_per_second is configured, which it is not by default. Repeating this across connections occupies every worker permitted by max_clients and denies service to legitimate clients at negligible bandwidth cost.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large `Content-Length` and then stalling before the body is complete.\n\n`httpd_request_handler:handle_info/2` cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with `{active, once}` without setting any further timer. `httpd_request:whole_body/2` returns such a continuation whenever the bytes received are fewer than the announced `Content-Length`, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when `minimum_bytes_per_second` is configured, which it is not by default. Repeating this across connections occupies every worker permitted by `max_clients` and denies service to legitimate clients at negligible bandwidth cost.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large `Content-Length` and then stalling before the body is complete.\n\n`httpd_request_handler:handle_info/2` cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with `{active, once}` without setting any further timer. `httpd_request:whole_body/2` returns such a continuation whenever the bytes received are fewer than the announced `Content-Length`, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when `minimum_bytes_per_second` is configured, which it is not by default. Repeating this across connections occupies every worker permitted by `max_clients` and denies service to legitimate clients at negligible bandwidth cost.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete.\n\nhttpd_request_handler:handle_info/2 cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with {active, once} without setting any further timer. httpd_request:whole_body/2 returns such a continuation whenever the bytes received are fewer than the announced Content-Length, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when minimum_bytes_per_second is configured, which it is not by default. Repeating this across connections occupies every worker permitted by max_clients and denies service to legitimate clients at negligible bandwidth cost.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete.\n\nhttpd_request_handler:handle_info/2 cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with {active, once} without setting any further timer. httpd_request:whole_body/2 returns such a continuation whenever the bytes received are fewer than the announced Content-Length, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when minimum_bytes_per_second is configured, which it is not by default. Repeating this across connections occupies every worker permitted by max_clients and denies service to legitimate clients at negligible bandwidth cost.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -284,7 +282,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:09:23.481Z" + "dateUpdated": "2026-11-11T13:47:09.255Z" }, "references": [ { @@ -295,24 +293,28 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-5vp4-58hc-h8cc" }, { + "name": "EEF CNA record for CVE-2026-71380", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-71380.html" }, { + "name": "OSV record EEF-CVE-2026-71380", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-71380" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Fix commit 81b453a in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/71xxx/CVE-2026-71562.json b/data/2026/71xxx/CVE-2026-71562.json index c3a896ac4e..94aad6c238 100644 --- a/data/2026/71xxx/CVE-2026-71562.json +++ b/data/2026/71xxx/CVE-2026-71562.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-07T15:15:01.474Z", "datePublished": "2026-09-01T14:33:41.833Z", - "dateUpdated": "2026-09-08T01:09:37.049Z" + "dateUpdated": "2026-11-11T13:42:41.581Z" }, "containers": { "cna": { @@ -17,7 +17,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpc_handler", "httpc_response" @@ -43,28 +43,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -72,13 +68,13 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpc_handler", "httpc_response" ], "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/http_client/httpc_handler.erl", @@ -99,28 +95,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -129,7 +121,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "httpc_handler", "httpc_response" @@ -170,6 +162,18 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa", + "versionType": "git" } ] } @@ -238,15 +242,15 @@ { "base64": false, "type": "text/html", - "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.

\n

httpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.

\n

httpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.\n\n`httpc_handler.erl` converts the server-supplied `Content-Length` with `list_to_integer/1` before comparing it against `max_body_size`, so the size check cannot protect the conversion, and the option defaults to `nolimit` in any case. The same unbounded conversion appears in `httpc_response:format_response/1` for `Content-Length` and in `httpc_response:get_ms_from_retry_after/1` for `Retry-After`, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.\n\n`httpc_handler.erl` converts the server-supplied `Content-Length` with `list_to_integer/1` before comparing it against `max_body_size`, so the size check cannot protect the conversion, and the option defaults to `nolimit` in any case. The same unbounded conversion appears in `httpc_response:format_response/1` for `Content-Length` and in `httpc_response:get_ms_from_retry_after/1` for `Retry-After`, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.\n\nhttpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.\n\nhttpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -309,7 +313,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:09:37.049Z" + "dateUpdated": "2026-11-11T13:42:41.581Z" }, "references": [ { @@ -320,30 +324,35 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-cqx9-9hq6-m8wf" }, { + "name": "EEF CNA record for CVE-2026-71562", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-71562.html" }, { + "name": "OSV record EEF-CVE-2026-71562", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-71562" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Fix commit aba0fe8 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d" }, { + "name": "Fix commit e3be1cf in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/73xxx/CVE-2026-73270.json b/data/2026/73xxx/CVE-2026-73270.json index 39f8edd53f..2e6357e8b3 100644 --- a/data/2026/73xxx/CVE-2026-73270.json +++ b/data/2026/73xxx/CVE-2026-73270.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T11:15:02.315Z", "datePublished": "2026-09-01T14:48:53.200Z", - "dateUpdated": "2026-09-08T01:09:49.755Z" + "dateUpdated": "2026-11-11T13:43:13.939Z" }, "containers": { "cna": { @@ -17,7 +17,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "mod_auth" ], @@ -35,28 +35,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -64,12 +60,12 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "mod_auth" ], "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": [ "src/http_server/mod_auth.erl" @@ -83,28 +79,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -113,7 +105,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "modules": [ "mod_auth" ], @@ -150,6 +142,24 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "d8878dec0ececc2eab18e47bb18b472f224ca633", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "9641944a2efbf55bea760f8ff7ba777fe3a0961c", + "versionType": "git" } ] } @@ -221,15 +231,15 @@ { "base64": false, "type": "text/html", - "value": "

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.

\n

mod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.

\n

mod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a `mod_auth` protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.\n\n`mod_auth:secret_path/3` decides whether a resolved filesystem path lies inside a protected `directory` block by running the configured directory path through `re:run/3` without the `caseless` option. A request for `/secret/file` against a directory configured as `/Secret` therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and `mod_get` serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a `mod_auth` protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.\n\n`mod_auth:secret_path/3` decides whether a resolved filesystem path lies inside a protected `directory` block by running the configured directory path through `re:run/3` without the `caseless` option. A request for `/secret/file` against a directory configured as `/Secret` therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and `mod_get` serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.\n\nmod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.\n\nmod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -292,7 +302,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:09:49.755Z" + "dateUpdated": "2026-11-11T13:43:13.939Z" }, "references": [ { @@ -303,36 +313,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-mh78-93cr-jx8f" }, { + "name": "EEF CNA record for CVE-2026-73270", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-73270.html" }, { + "name": "OSV record EEF-CVE-2026-73270", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-73270" }, { + "name": "Erlang/OTP version ordering", "tags": [ "x_version-scheme" ], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" }, { + "name": "Fix commit bac19eb in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6" }, { + "name": "Fix commit d8878de in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/d8878dec0ececc2eab18e47bb18b472f224ca633" }, { + "name": "Fix commit 9641944 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/73xxx/CVE-2026-73276.json b/data/2026/73xxx/CVE-2026-73276.json index 20fb9d920b..7e19d3dac0 100644 --- a/data/2026/73xxx/CVE-2026-73276.json +++ b/data/2026/73xxx/CVE-2026-73276.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-12T20:00:01.107Z", "datePublished": "2026-09-01T14:41:24.565Z", - "dateUpdated": "2026-09-08T01:10:02.081Z" + "dateUpdated": "2026-11-11T13:44:01.526Z" }, "containers": { "cna": { @@ -24,22 +24,24 @@ "vendor": "Erlang", "versions": [ { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "22.2", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -49,28 +51,30 @@ ], "defaultStatus": "unaffected", "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "7.1.2", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -159,15 +163,15 @@ { "base64": false, "type": "text/html", - "value": "

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.

\n

This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

" + "value": "

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.

\n

This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2.

" }, { "base64": false, "type": "text/markdown", - "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2." + "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2." } ], - "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2." + "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2." } ], "impacts": [ @@ -220,7 +224,7 @@ "descriptions": [ { "cweId": "CWE-444", - "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", + "description": "CWE-444 Inconsistent Interpretation of HTTP Requests", "lang": "en", "type": "CWE" } @@ -230,7 +234,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:10:02.081Z" + "dateUpdated": "2026-11-11T13:44:01.526Z" }, "references": [ { @@ -240,30 +244,49 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p" }, { + "name": "EEF CNA record for CVE-2026-73276", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-73276.html" }, { + "name": "OSV record EEF-CVE-2026-73276", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-73276" }, { + "name": "Erlang/OTP version ordering", + "tags": [ + "x_version-scheme" + ], + "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" + }, + { + "name": "Introducing commit c06db0b in erlang/otp", + "tags": [ + "related" + ], + "url": "https://github.com/erlang/otp/commit/c06db0bedf49a9b40725745e73fa82e562612815" + }, + { + "name": "Fix commit 60add5a in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683" }, { + "name": "Fix commit 6cd995e in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c" }, { + "name": "Fix commit c285240 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/73xxx/CVE-2026-73812.json b/data/2026/73xxx/CVE-2026-73812.json index 061bb99d6f..36794f5412 100644 --- a/data/2026/73xxx/CVE-2026-73812.json +++ b/data/2026/73xxx/CVE-2026-73812.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T11:00:01.498Z", "datePublished": "2026-09-01T14:42:42.374Z", - "dateUpdated": "2026-09-08T01:10:14.000Z" + "dateUpdated": "2026-11-11T13:44:38.119Z" }, "containers": { "cna": { @@ -17,35 +17,31 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -53,36 +49,32 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -91,7 +83,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", @@ -103,6 +95,12 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "591dc00dc99dc2a426167a3b5257c0c94bd45e91", + "versionType": "git" } ] } @@ -156,15 +154,15 @@ { "base64": false, "type": "text/html", - "value": "

httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -217,7 +215,7 @@ "descriptions": [ { "cweId": "CWE-444", - "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", + "description": "CWE-444 Inconsistent Interpretation of HTTP Requests", "lang": "en", "type": "CWE" } @@ -227,7 +225,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:10:14.000Z" + "dateUpdated": "2026-11-11T13:44:38.119Z" }, "references": [ { @@ -237,18 +235,28 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46" }, { + "name": "EEF CNA record for CVE-2026-73812", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-73812.html" }, { + "name": "OSV record EEF-CVE-2026-73812", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-73812" }, { + "name": "Erlang/OTP version ordering", + "tags": [ + "x_version-scheme" + ], + "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" + }, + { + "name": "Fix commit 591dc00 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/74xxx/CVE-2026-74835.json b/data/2026/74xxx/CVE-2026-74835.json index 01b5e17086..82ce8fb6b6 100644 --- a/data/2026/74xxx/CVE-2026-74835.json +++ b/data/2026/74xxx/CVE-2026-74835.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T12:30:01.524Z", "datePublished": "2026-09-01T14:45:16.377Z", - "dateUpdated": "2026-09-08T01:10:27.102Z" + "dateUpdated": "2026-11-11T13:45:05.856Z" }, "containers": { "cna": { @@ -17,35 +17,31 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -53,36 +49,32 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -91,7 +83,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", @@ -117,6 +109,24 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "8e1ca42b64df6c41306affbe8dc129bdbd4042c7", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "7f9c460d1818c2afb78fbd01f8d8b81343bbb011", + "versionType": "git" } ] } @@ -170,15 +180,15 @@ { "base64": false, "type": "text/html", - "value": "

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -250,7 +260,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:10:27.102Z" + "dateUpdated": "2026-11-11T13:45:05.856Z" }, "references": [ { @@ -260,30 +270,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5" }, { + "name": "EEF CNA record for CVE-2026-74835", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-74835.html" }, { + "name": "OSV record EEF-CVE-2026-74835", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-74835" }, { + "name": "Erlang/OTP version ordering", + "tags": [ + "x_version-scheme" + ], + "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" + }, + { + "name": "Fix commit 0bceff0 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86" }, { + "name": "Fix commit 8e1ca42 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/8e1ca42b64df6c41306affbe8dc129bdbd4042c7" }, { + "name": "Fix commit 7f9c460 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/74xxx/CVE-2026-74860.json b/data/2026/74xxx/CVE-2026-74860.json index 7ac2ade6f2..98588b0842 100644 --- a/data/2026/74xxx/CVE-2026-74860.json +++ b/data/2026/74xxx/CVE-2026-74860.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-08-17T09:57:05.862Z", "datePublished": "2026-09-08T11:27:45.158Z", - "dateUpdated": "2026-11-11T11:30:19.906Z" + "dateUpdated": "2026-11-11T13:22:48.574Z" }, "containers": { "cna": { @@ -303,6 +303,25 @@ "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "libxml2", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.9.13-18.el9_9.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/o:redhat:enterprise_linux:9::baseos" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", @@ -322,6 +341,25 @@ "cpe:/o:redhat:enterprise_linux:9::baseos" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 9", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "libxml2", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:2.9.13-18.el9_9.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/a:redhat:enterprise_linux:9::appstream", + "cpe:/o:redhat:enterprise_linux:9::baseos" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", @@ -1529,6 +1567,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98468", + "name": "RHSA-2026:98468", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/errata/RHSA-2026:98572", "name": "RHSA-2026:98572", @@ -1582,7 +1628,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T11:30:19.906Z" + "dateUpdated": "2026-11-11T13:22:48.574Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/74xxx/CVE-2026-74994.json b/data/2026/74xxx/CVE-2026-74994.json index 20b373c2c5..9701662a34 100644 --- a/data/2026/74xxx/CVE-2026-74994.json +++ b/data/2026/74xxx/CVE-2026-74994.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-17T13:00:01.418Z", "datePublished": "2026-09-01T14:45:57.537Z", - "dateUpdated": "2026-09-08T01:10:39.103Z" + "dateUpdated": "2026-11-11T13:45:44.238Z" }, "containers": { "cna": { @@ -17,35 +17,31 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -53,36 +49,32 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "inets", - "packageURL": "pkg:otp/inets", + "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { - "lessThan": "5.10", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "9.3.2.7", + "changes": [ + { + "at": "9.3.2.7", + "status": "unaffected" + }, + { + "at": "9.6.2.3", + "status": "unaffected" + }, + { + "at": "9.7.2", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp" - }, - { - "lessThan": "9.6.2.3", - "status": "affected", - "version": "9.4", - "versionType": "otp" - }, - { - "lessThan": "9.7.2", - "status": "affected", - "version": "9.7", - "versionType": "otp" } ] }, @@ -91,7 +83,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", @@ -117,6 +109,24 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "6982e381137ede21a4e1faf5fa2dd82321691176", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "c5ccec8ed25c70ec6557fd81277e4b2f52285c19", + "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "6101cb74ff2870718c622ba7af0c100f7f2524e3", + "versionType": "git" } ] } @@ -170,15 +180,15 @@ { "base64": false, "type": "text/html", - "value": "

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one\nprotected directory is accepted as valid for all other protected directories on the same server instance.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" + "value": "

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one\nprotected directory is accepted as valid for all other protected directories on the same server instance.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one\nprotected directory is accepted as valid for all other protected directories on the same server instance.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one\nprotected directory is accepted as valid for all other protected directories on the same server instance.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], - "value": "The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." + "value": "The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown." } ], "impacts": [ @@ -260,7 +270,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:10:39.103Z" + "dateUpdated": "2026-11-11T13:45:44.238Z" }, "references": [ { @@ -270,30 +280,42 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-c3cq-q8x6-547g" }, { + "name": "EEF CNA record for CVE-2026-74994", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-74994.html" }, { + "name": "OSV record EEF-CVE-2026-74994", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-74994" }, { + "name": "Erlang/OTP version ordering", + "tags": [ + "x_version-scheme" + ], + "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" + }, + { + "name": "Fix commit 6982e38 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/6982e381137ede21a4e1faf5fa2dd82321691176" }, { + "name": "Fix commit c5ccec8 in erlang/otp", "tags": [ "patch" ], "url": "https://github.com/erlang/otp/commit/c5ccec8ed25c70ec6557fd81277e4b2f52285c19" }, { + "name": "Fix commit 6101cb7 in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/75xxx/CVE-2026-75538.json b/data/2026/75xxx/CVE-2026-75538.json index ff622604c7..b189ff7001 100644 --- a/data/2026/75xxx/CVE-2026-75538.json +++ b/data/2026/75xxx/CVE-2026-75538.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-20T10:15:01.237Z", "datePublished": "2026-09-01T14:48:26.309Z", - "dateUpdated": "2026-09-08T01:10:53.139Z" + "dateUpdated": "2026-11-11T13:34:33.003Z" }, "containers": { "cna": { @@ -17,35 +17,31 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [ { - "lessThan": "17.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "27.3.4.17", + "changes": [ + { + "at": "27.3.4.17", + "status": "unaffected" + }, + { + "at": "28.5.0.6", + "status": "unaffected" + }, + { + "at": "29.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp" - }, - { - "lessThan": "28.5.0.6", - "status": "affected", - "version": "28.0", - "versionType": "otp" - }, - { - "lessThan": "29.0.6", - "status": "affected", - "version": "29.0", - "versionType": "otp" } ] }, @@ -53,36 +49,32 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "erts", - "packageURL": "pkg:otp/erts", + "packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [ { - "lessThan": "6.0", - "status": "unknown", - "version": "0", - "versionType": "otp" - }, - { - "lessThan": "15.2.7.13", + "changes": [ + { + "at": "15.2.7.13", + "status": "unaffected" + }, + { + "at": "16.4.0.6", + "status": "unaffected" + }, + { + "at": "17.0.6", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "6.0", "versionType": "otp" - }, - { - "lessThan": "16.4.0.6", - "status": "affected", - "version": "16.0", - "versionType": "otp" - }, - { - "lessThan": "17.0.6", - "status": "affected", - "version": "17.0", - "versionType": "otp" } ] }, @@ -91,7 +83,7 @@ "cpes": [ "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*" ], - "defaultStatus": "unaffected", + "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", @@ -103,6 +95,12 @@ "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git" + }, + { + "lessThan": "*", + "status": "unaffected", + "version": "08e8efdba8500d2d6f54c6b1de1492b228017c9b", + "versionType": "git" } ] } @@ -176,15 +174,15 @@ { "base64": false, "type": "text/html", - "value": "

An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB.

\n

This would easily trash the allocated block's allocator metadata footer, and the next block, if any, and most likely cause the BEAM VM to crash. Utilizing this with precision enough to achieve Remote Code Execution would be extremely unfeasible.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to erts from 6.0 before 15.2.7.13, from 16.0 before 16.4.0.6, and from 17.0 before 17.0.6. Whether OTP before OTP 17.0, corresponding to erts before 6.0, is affected is unknown.

" + "value": "

An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB.

\n

This would easily trash the allocated block's allocator metadata footer, and the next block, if any, and most likely cause the BEAM VM to crash. Utilizing this with precision enough to achieve Remote Code Execution would be extremely unfeasible.

\n

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to erts from 6.0 before 15.2.7.13, 16.4.0.6, and 17.0.6. Whether OTP before OTP 17.0, corresponding to erts before 6.0, is affected is unknown.

" }, { "base64": false, "type": "text/markdown", - "value": "An attacker that connects to an open Erlang TCP port that uses the inet driver with `{packet,4}` mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB.\n\nThis would easily trash the allocated block's allocator metadata footer, and the next block, if any, and most likely cause the BEAM VM to crash. Utilizing this with precision enough to achieve Remote Code Execution would be extremely unfeasible.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to erts from 6.0 before 15.2.7.13, from 16.0 before 16.4.0.6, and from 17.0 before 17.0.6. Whether OTP before OTP 17.0, corresponding to erts before 6.0, is affected is unknown." + "value": "An attacker that connects to an open Erlang TCP port that uses the inet driver with `{packet,4}` mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB.\n\nThis would easily trash the allocated block's allocator metadata footer, and the next block, if any, and most likely cause the BEAM VM to crash. Utilizing this with precision enough to achieve Remote Code Execution would be extremely unfeasible.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to erts from 6.0 before 15.2.7.13, 16.4.0.6, and 17.0.6. Whether OTP before OTP 17.0, corresponding to erts before 6.0, is affected is unknown." } ], - "value": "An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB.\n\nThis would easily trash the allocated block's allocator metadata footer, and the next block, if any, and most likely cause the BEAM VM to crash. Utilizing this with precision enough to achieve Remote Code Execution would be extremely unfeasible.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to erts from 6.0 before 15.2.7.13, from 16.0 before 16.4.0.6, and from 17.0 before 17.0.6. Whether OTP before OTP 17.0, corresponding to erts before 6.0, is affected is unknown." + "value": "An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB.\n\nThis would easily trash the allocated block's allocator metadata footer, and the next block, if any, and most likely cause the BEAM VM to crash. Utilizing this with precision enough to achieve Remote Code Execution would be extremely unfeasible.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to erts from 6.0 before 15.2.7.13, 16.4.0.6, and 17.0.6. Whether OTP before OTP 17.0, corresponding to erts before 6.0, is affected is unknown." } ], "impacts": [ @@ -257,7 +255,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-09-08T01:10:53.139Z" + "dateUpdated": "2026-11-11T13:34:33.003Z" }, "references": [ { @@ -267,18 +265,28 @@ "url": "https://github.com/erlang/otp/security/advisories/GHSA-8m6r-2pj2-25pm" }, { + "name": "EEF CNA record for CVE-2026-75538", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-75538.html" }, { + "name": "OSV record EEF-CVE-2026-75538", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-75538" }, { + "name": "Erlang/OTP version ordering", + "tags": [ + "x_version-scheme" + ], + "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions" + }, + { + "name": "Fix commit 08e8efd in erlang/otp", "tags": [ "patch" ], diff --git a/data/2026/81xxx/CVE-2026-81856.json b/data/2026/81xxx/CVE-2026-81856.json index ef00df6ee2..3bd75f7563 100644 --- a/data/2026/81xxx/CVE-2026-81856.json +++ b/data/2026/81xxx/CVE-2026-81856.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-08-31T00:45:02.431Z", "datePublished": "2026-10-12T15:46:12.146Z", - "dateUpdated": "2026-10-16T17:47:15.339Z" + "dateUpdated": "2026-11-11T13:31:44.405Z" }, "containers": { "cna": { @@ -22,7 +22,7 @@ "'Elixir.Mix.Tasks.Hex.Search'" ], "packageName": "hex", - "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", + "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": [ "lib/mix/tasks/hex.search.ex" @@ -67,7 +67,17 @@ "vendor": "hexpm", "versions": [ { - "lessThan": "dd3305ddf0032f6d0b468fd40dbbc3072bfcb8b8", + "changes": [ + { + "at": "dd3305ddf0032f6d0b468fd40dbbc3072bfcb8b8", + "status": "unaffected" + }, + { + "at": "4a9a865c00add6985e04ce33e9c775df9cf8fc38", + "status": "unaffected" + } + ], + "lessThan": "*", "status": "affected", "version": "211303e3f68f5d3ce06450c1ff1a7a770a9ab236", "versionType": "git" @@ -135,6 +145,7 @@ } ], "dateAssigned": "2026-09-09T16:47:17.000Z", + "datePublic": "2026-10-12T15:46:12.000Z", "descriptions": [ { "lang": "en", @@ -225,7 +236,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-10-12T15:46:12.146Z" + "dateUpdated": "2026-11-11T13:31:44.405Z" }, "references": [ { @@ -263,6 +274,13 @@ "patch" ], "url": "https://github.com/hexpm/hex/commit/dd3305ddf0032f6d0b468fd40dbbc3072bfcb8b8" + }, + { + "name": "Fix commit 4a9a865 in hexpm/hex", + "tags": [ + "patch" + ], + "url": "https://github.com/hexpm/hex/commit/4a9a865c00add6985e04ce33e9c775df9cf8fc38" } ], "solutions": [ diff --git a/data/2026/84xxx/CVE-2026-84268.json b/data/2026/84xxx/CVE-2026-84268.json index 62a7c85f2f..7385c81771 100644 --- a/data/2026/84xxx/CVE-2026-84268.json +++ b/data/2026/84xxx/CVE-2026-84268.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-01T14:05:54.144Z", "datePublished": "2026-09-01T15:15:23.685Z", - "dateUpdated": "2026-11-04T23:46:58.255Z" + "dateUpdated": "2026-11-11T13:55:56.972Z" }, "containers": { "cna": { @@ -81,6 +81,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gvfs", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.54.4-5.el10_3.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", @@ -424,6 +442,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98623", + "name": "RHSA-2026:98623", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-84268", "tags": [ @@ -484,7 +510,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-04T23:46:58.255Z" + "dateUpdated": "2026-11-11T13:55:56.972Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86320.json b/data/2026/86xxx/CVE-2026-86320.json index 59c364af34..511052dee6 100644 --- a/data/2026/86xxx/CVE-2026-86320.json +++ b/data/2026/86xxx/CVE-2026-86320.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-07T05:35:25.012Z", "datePublished": "2026-09-17T07:27:33.167Z", - "dateUpdated": "2026-11-11T12:38:37.300Z" + "dateUpdated": "2026-11-11T13:59:07.143Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak-builder", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.4.7-1.el10_3.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", @@ -396,6 +414,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98642", + "name": "RHSA-2026:98642", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86320", "tags": [ @@ -456,7 +482,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:38:37.300Z" + "dateUpdated": "2026-11-11T13:59:07.143Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86561.json b/data/2026/86xxx/CVE-2026-86561.json index 701334382e..fdffe3f5d3 100644 --- a/data/2026/86xxx/CVE-2026-86561.json +++ b/data/2026/86xxx/CVE-2026-86561.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T02:56:12.292Z", "datePublished": "2026-10-14T15:42:42.527Z", - "dateUpdated": "2026-11-11T12:20:12.875Z" + "dateUpdated": "2026-11-11T13:54:07.356Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86561", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:12.875Z" + "dateUpdated": "2026-11-11T13:54:07.356Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86562.json b/data/2026/86xxx/CVE-2026-86562.json index dd609d23e5..d3457b9e37 100644 --- a/data/2026/86xxx/CVE-2026-86562.json +++ b/data/2026/86xxx/CVE-2026-86562.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T02:56:17.270Z", "datePublished": "2026-10-14T16:07:58.562Z", - "dateUpdated": "2026-11-11T12:14:56.710Z" + "dateUpdated": "2026-11-11T13:50:48.994Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86562", "tags": [ @@ -445,7 +471,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:14:56.710Z" + "dateUpdated": "2026-11-11T13:50:48.994Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86563.json b/data/2026/86xxx/CVE-2026-86563.json index eb0ad0b003..749b88459d 100644 --- a/data/2026/86xxx/CVE-2026-86563.json +++ b/data/2026/86xxx/CVE-2026-86563.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T02:56:25.265Z", "datePublished": "2026-10-14T16:08:04.096Z", - "dateUpdated": "2026-11-11T12:14:57.536Z" + "dateUpdated": "2026-11-11T13:50:49.598Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86563", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:14:57.536Z" + "dateUpdated": "2026-11-11T13:50:49.598Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86565.json b/data/2026/86xxx/CVE-2026-86565.json index 63ca53ce1c..c301b1e545 100644 --- a/data/2026/86xxx/CVE-2026-86565.json +++ b/data/2026/86xxx/CVE-2026-86565.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T02:56:38.874Z", "datePublished": "2026-10-14T16:08:22.760Z", - "dateUpdated": "2026-11-11T12:15:02.486Z" + "dateUpdated": "2026-11-11T13:50:54.233Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86565", "tags": [ @@ -436,7 +462,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:15:02.486Z" + "dateUpdated": "2026-11-11T13:50:54.233Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86566.json b/data/2026/86xxx/CVE-2026-86566.json index 32b2eb95f1..077afb9f77 100644 --- a/data/2026/86xxx/CVE-2026-86566.json +++ b/data/2026/86xxx/CVE-2026-86566.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T02:56:43.567Z", "datePublished": "2026-10-14T17:52:01.224Z", - "dateUpdated": "2026-11-11T12:20:14.269Z" + "dateUpdated": "2026-11-11T13:54:08.495Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86566", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:14.269Z" + "dateUpdated": "2026-11-11T13:54:08.495Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86567.json b/data/2026/86xxx/CVE-2026-86567.json index 8db7537b94..cd1ad18d75 100644 --- a/data/2026/86xxx/CVE-2026-86567.json +++ b/data/2026/86xxx/CVE-2026-86567.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T02:56:53.901Z", "datePublished": "2026-10-14T17:50:03.467Z", - "dateUpdated": "2026-11-11T12:15:03.126Z" + "dateUpdated": "2026-11-11T13:50:56.346Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86567", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:15:03.126Z" + "dateUpdated": "2026-11-11T13:50:56.346Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86845.json b/data/2026/86xxx/CVE-2026-86845.json index 9eaeddc068..6dba2713f6 100644 --- a/data/2026/86xxx/CVE-2026-86845.json +++ b/data/2026/86xxx/CVE-2026-86845.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T14:54:06.881Z", "datePublished": "2026-10-14T17:52:06.749Z", - "dateUpdated": "2026-11-11T12:20:15.211Z" + "dateUpdated": "2026-11-11T13:54:09.047Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86845", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:15.211Z" + "dateUpdated": "2026-11-11T13:54:09.047Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86846.json b/data/2026/86xxx/CVE-2026-86846.json index 836be46108..80b92edf65 100644 --- a/data/2026/86xxx/CVE-2026-86846.json +++ b/data/2026/86xxx/CVE-2026-86846.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T14:54:10.839Z", "datePublished": "2026-10-14T17:52:07.604Z", - "dateUpdated": "2026-11-11T12:20:18.228Z" + "dateUpdated": "2026-11-11T13:54:12.081Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86846", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:18.228Z" + "dateUpdated": "2026-11-11T13:54:12.081Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86847.json b/data/2026/86xxx/CVE-2026-86847.json index 0d5c4ac650..f47b579b37 100644 --- a/data/2026/86xxx/CVE-2026-86847.json +++ b/data/2026/86xxx/CVE-2026-86847.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T14:54:15.212Z", "datePublished": "2026-10-14T17:52:12.797Z", - "dateUpdated": "2026-11-11T12:20:19.351Z" + "dateUpdated": "2026-11-11T13:54:14.086Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86847", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:19.351Z" + "dateUpdated": "2026-11-11T13:54:14.086Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86848.json b/data/2026/86xxx/CVE-2026-86848.json index b22e606d3c..b1913c56ba 100644 --- a/data/2026/86xxx/CVE-2026-86848.json +++ b/data/2026/86xxx/CVE-2026-86848.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T14:54:19.899Z", "datePublished": "2026-10-14T17:50:08.022Z", - "dateUpdated": "2026-11-11T12:15:08.424Z" + "dateUpdated": "2026-11-11T13:51:01.613Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86848", "tags": [ @@ -436,7 +462,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:15:08.424Z" + "dateUpdated": "2026-11-11T13:51:01.613Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86849.json b/data/2026/86xxx/CVE-2026-86849.json index 9bc4a7bd1e..243d3311f1 100644 --- a/data/2026/86xxx/CVE-2026-86849.json +++ b/data/2026/86xxx/CVE-2026-86849.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T14:54:30.255Z", "datePublished": "2026-10-14T17:52:15.802Z", - "dateUpdated": "2026-11-11T12:20:23.123Z" + "dateUpdated": "2026-11-11T13:54:16.433Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86849", "tags": [ @@ -436,7 +462,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:23.123Z" + "dateUpdated": "2026-11-11T13:54:16.433Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/86xxx/CVE-2026-86856.json b/data/2026/86xxx/CVE-2026-86856.json index 970a8b5913..7787f93938 100644 --- a/data/2026/86xxx/CVE-2026-86856.json +++ b/data/2026/86xxx/CVE-2026-86856.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-08T15:39:19.083Z", "datePublished": "2026-10-14T17:52:14.805Z", - "dateUpdated": "2026-11-11T12:20:27.123Z" + "dateUpdated": "2026-11-11T13:54:16.443Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -385,6 +403,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86856", "tags": [ @@ -442,7 +468,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:27.123Z" + "dateUpdated": "2026-11-11T13:54:16.443Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/88xxx/CVE-2026-88924.json b/data/2026/88xxx/CVE-2026-88924.json index 0465fc58b4..5ad8513501 100644 --- a/data/2026/88xxx/CVE-2026-88924.json +++ b/data/2026/88xxx/CVE-2026-88924.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-10T14:04:13.603Z", "datePublished": "2026-09-10T14:32:30.644Z", - "dateUpdated": "2026-11-04T23:56:25.067Z" + "dateUpdated": "2026-11-11T13:56:00.052Z" }, "containers": { "cna": { @@ -93,6 +93,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "gvfs", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.54.4-5.el10_3.1", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", @@ -265,6 +283,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98623", + "name": "RHSA-2026:98623", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-88924", "tags": [ @@ -325,7 +351,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-04T23:56:25.067Z" + "dateUpdated": "2026-11-11T13:56:00.052Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/91xxx/CVE-2026-91000.json b/data/2026/91xxx/CVE-2026-91000.json index d755a673e4..3855bfabd6 100644 --- a/data/2026/91xxx/CVE-2026-91000.json +++ b/data/2026/91xxx/CVE-2026-91000.json @@ -8,7 +8,7 @@ "assignerShortName": "N-able", "dateReserved": "2026-09-14T15:25:41.366Z", "datePublished": "2026-11-10T21:19:57.597Z", - "dateUpdated": "2026-11-10T21:19:57.597Z" + "dateUpdated": "2026-11-11T14:02:43.025Z" }, "containers": { "cna": { @@ -119,6 +119,40 @@ "x_generator": { "engine": "Vulnogram 1.0.5" } - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T14:02:31.388178Z", + "id": "CVE-2026-91000", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T14:02:43.025Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/93xxx/CVE-2026-93427.json b/data/2026/93xxx/CVE-2026-93427.json index 9812953e5d..78d057d816 100644 --- a/data/2026/93xxx/CVE-2026-93427.json +++ b/data/2026/93xxx/CVE-2026-93427.json @@ -8,7 +8,7 @@ "assignerShortName": "Wordfence", "dateReserved": "2026-09-17T21:01:01.621Z", "datePublished": "2026-11-10T06:47:02.854Z", - "dateUpdated": "2026-11-10T06:47:02.854Z" + "dateUpdated": "2026-11-11T13:49:35.913Z" }, "containers": { "cna": { @@ -88,6 +88,40 @@ "value": "Disclosed" } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2026-11-11T13:40:09.913084Z", + "id": "CVE-2026-93427", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2026-11-11T13:49:35.913Z" + } + } + ] } } \ No newline at end of file diff --git a/data/2026/93xxx/CVE-2026-93683.json b/data/2026/93xxx/CVE-2026-93683.json index 4d632a4c31..591e04ea73 100644 --- a/data/2026/93xxx/CVE-2026-93683.json +++ b/data/2026/93xxx/CVE-2026-93683.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-18T14:22:36.511Z", "datePublished": "2026-10-14T15:42:35.398Z", - "dateUpdated": "2026-11-11T12:20:29.968Z" + "dateUpdated": "2026-11-11T13:54:21.867Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "dpdk", + "defaultStatus": "affected", + "versions": [ + { + "version": "2:25.11-2.el10_3", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", @@ -365,6 +383,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98616", + "name": "RHSA-2026:98616", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-93683", "tags": [ @@ -422,7 +448,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:20:29.968Z" + "dateUpdated": "2026-11-11T13:54:21.867Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96275.json b/data/2026/96xxx/CVE-2026-96275.json index ff5d28eaa2..c12c39b55b 100644 --- a/data/2026/96xxx/CVE-2026-96275.json +++ b/data/2026/96xxx/CVE-2026-96275.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-22T20:42:17.038Z", "datePublished": "2026-09-23T15:01:38.344Z", - "dateUpdated": "2026-11-11T12:04:21.482Z" + "dateUpdated": "2026-11-11T13:37:25.264Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.18.0-2.el10_3.4", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", @@ -410,6 +428,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98595", + "name": "RHSA-2026:98595", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96275", "tags": [ @@ -470,7 +496,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:04:21.482Z" + "dateUpdated": "2026-11-11T13:37:25.264Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96280.json b/data/2026/96xxx/CVE-2026-96280.json index b5e6710c6d..a6c68f38cb 100644 --- a/data/2026/96xxx/CVE-2026-96280.json +++ b/data/2026/96xxx/CVE-2026-96280.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-22T20:43:35.900Z", "datePublished": "2026-09-27T20:19:12.890Z", - "dateUpdated": "2026-11-11T12:08:39.010Z" + "dateUpdated": "2026-11-11T13:37:39.770Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.18.0-2.el10_3.4", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", @@ -410,6 +428,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98595", + "name": "RHSA-2026:98595", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96280", "tags": [ @@ -470,7 +496,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:08:39.010Z" + "dateUpdated": "2026-11-11T13:37:39.770Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/96xxx/CVE-2026-96612.json b/data/2026/96xxx/CVE-2026-96612.json index 7fcbf395dc..946078abe2 100644 --- a/data/2026/96xxx/CVE-2026-96612.json +++ b/data/2026/96xxx/CVE-2026-96612.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-10-01T09:00:02.103Z", "datePublished": "2026-10-12T15:39:49.862Z", - "dateUpdated": "2026-10-16T17:41:58.545Z" + "dateUpdated": "2026-11-11T13:28:28.140Z" }, "containers": { "cna": { @@ -24,7 +24,7 @@ "'Elixir.Hex.SCM'" ], "packageName": "hex", - "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", + "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": [ "lib/hex/remote_converger.ex", @@ -172,6 +172,7 @@ } ], "dateAssigned": "2026-10-07T22:03:18.000Z", + "datePublic": "2026-10-12T15:39:50.000Z", "descriptions": [ { "lang": "en", @@ -252,7 +253,7 @@ "descriptions": [ { "cweId": "CWE-22", - "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", + "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory", "lang": "en", "type": "CWE" } @@ -262,7 +263,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-10-12T15:39:49.862Z" + "dateUpdated": "2026-11-11T13:28:28.140Z" }, "references": [ { diff --git a/data/2026/96xxx/CVE-2026-96618.json b/data/2026/96xxx/CVE-2026-96618.json index 6432ea4666..7733d01118 100644 --- a/data/2026/96xxx/CVE-2026-96618.json +++ b/data/2026/96xxx/CVE-2026-96618.json @@ -8,7 +8,7 @@ "assignerShortName": "EEF", "dateReserved": "2026-10-10T13:00:02.352Z", "datePublished": "2026-10-12T15:29:19.117Z", - "dateUpdated": "2026-10-16T17:33:51.114Z" + "dateUpdated": "2026-11-11T13:27:29.636Z" }, "containers": { "cna": { @@ -24,7 +24,7 @@ "'Elixir.Mix.Tasks.Hex.Docs'" ], "packageName": "hex", - "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", + "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": [ "lib/hex/http.ex", @@ -166,6 +166,7 @@ } ], "dateAssigned": "2026-10-10T13:00:30.000Z", + "datePublic": "2026-10-12T15:29:19.000Z", "descriptions": [ { "lang": "en", @@ -266,7 +267,7 @@ "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", - "dateUpdated": "2026-10-12T15:29:19.117Z" + "dateUpdated": "2026-11-11T13:27:29.636Z" }, "references": [ { diff --git a/data/2026/97xxx/CVE-2026-97023.json b/data/2026/97xxx/CVE-2026-97023.json index 1ba39324f7..c30e39abd2 100644 --- a/data/2026/97xxx/CVE-2026-97023.json +++ b/data/2026/97xxx/CVE-2026-97023.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-23T21:06:34.212Z", "datePublished": "2026-09-28T18:53:28.600Z", - "dateUpdated": "2026-11-11T12:04:26.701Z" + "dateUpdated": "2026-11-11T13:37:38.246Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.18.0-2.el10_3.4", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", @@ -272,6 +290,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98595", + "name": "RHSA-2026:98595", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97023", "tags": [ @@ -332,7 +358,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:04:26.701Z" + "dateUpdated": "2026-11-11T13:37:38.246Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/2026/97xxx/CVE-2026-97024.json b/data/2026/97xxx/CVE-2026-97024.json index 7779f668d3..49dfedd183 100644 --- a/data/2026/97xxx/CVE-2026-97024.json +++ b/data/2026/97xxx/CVE-2026-97024.json @@ -8,7 +8,7 @@ "assignerShortName": "redhat", "dateReserved": "2026-09-23T21:09:09.344Z", "datePublished": "2026-09-29T03:23:00.602Z", - "dateUpdated": "2026-11-11T12:04:29.017Z" + "dateUpdated": "2026-11-11T13:37:39.155Z" }, "containers": { "cna": { @@ -66,6 +66,24 @@ "cpe:/o:redhat:enterprise_linux:10.2" ] }, + { + "vendor": "Red Hat", + "product": "Red Hat Enterprise Linux 10", + "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", + "packageName": "flatpak", + "defaultStatus": "affected", + "versions": [ + { + "version": "0:1.18.0-2.el10_3.4", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "cpes": [ + "cpe:/o:redhat:enterprise_linux:10.3" + ] + }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", @@ -272,6 +290,14 @@ "x_refsource_REDHAT" ] }, + { + "url": "https://access.redhat.com/errata/RHSA-2026:98595", + "name": "RHSA-2026:98595", + "tags": [ + "vendor-advisory", + "x_refsource_REDHAT" + ] + }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97024", "tags": [ @@ -332,7 +358,7 @@ "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", - "dateUpdated": "2026-11-11T12:04:29.017Z" + "dateUpdated": "2026-11-11T13:37:39.155Z" }, "x_generator": { "engine": "cvelib 1.8.0" diff --git a/data/delta.json b/data/delta.json index b7c6d10099..2c37070899 100644 --- a/data/delta.json +++ b/data/delta.json @@ -1,26 +1,68 @@ { - "fetchTime": "2026-11-11T13:20:32.783Z", - "numberOfChanges": 3, - "new": [ + "fetchTime": "2026-11-11T14:15:20.040Z", + "numberOfChanges": 10, + "new": [], + "updated": [ { - "cveId": "CVE-2026-125850", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125850", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125850.json", - "dateUpdated": "2026-11-11T13:16:12.172Z" + "cveId": "CVE-2026-103503", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103503", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103503.json", + "dateUpdated": "2026-11-11T14:04:54.738Z" }, { - "cveId": "CVE-2026-40853", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-40853", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/40xxx/CVE-2026-40853.json", - "dateUpdated": "2026-11-11T13:16:13.608Z" + "cveId": "CVE-2026-105274", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105274", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105274.json", + "dateUpdated": "2026-11-11T14:05:54.298Z" }, { - "cveId": "CVE-2026-48479", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-48479", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48479.json", - "dateUpdated": "2026-11-11T13:18:49.334Z" + "cveId": "CVE-2026-105280", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105280", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105280.json", + "dateUpdated": "2026-11-11T14:03:00.287Z" + }, + { + "cveId": "CVE-2026-114690", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114690", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114690.json", + "dateUpdated": "2026-11-11T14:04:00.142Z" + }, + { + "cveId": "CVE-2026-114691", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114691", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114691.json", + "dateUpdated": "2026-11-11T14:04:00.245Z" + }, + { + "cveId": "CVE-2026-115455", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115455", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115455.json", + "dateUpdated": "2026-11-11T14:04:00.225Z" + }, + { + "cveId": "CVE-2026-115456", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115456", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115456.json", + "dateUpdated": "2026-11-11T14:04:29.305Z" + }, + { + "cveId": "CVE-2026-32146", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32146", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32146.json", + "dateUpdated": "2026-11-11T14:13:44.294Z" + }, + { + "cveId": "CVE-2026-70399", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-70399", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70399.json", + "dateUpdated": "2026-11-11T14:07:28.956Z" + }, + { + "cveId": "CVE-2026-91000", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91000", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91000.json", + "dateUpdated": "2026-11-11T14:02:43.025Z" } ], - "updated": [], "error": [] } \ No newline at end of file diff --git a/data/deltaLog.json b/data/deltaLog.json index 2dba550bba..2f21981e4f 100644 --- a/data/deltaLog.json +++ b/data/deltaLog.json @@ -1,4 +1,835 @@ [ + { + "fetchTime": "2026-11-11T14:15:20.040Z", + "numberOfChanges": 10, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-103503", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103503", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103503.json", + "dateUpdated": "2026-11-11T14:04:54.738Z" + }, + { + "cveId": "CVE-2026-105274", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105274", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105274.json", + "dateUpdated": "2026-11-11T14:05:54.298Z" + }, + { + "cveId": "CVE-2026-105280", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105280", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105280.json", + "dateUpdated": "2026-11-11T14:03:00.287Z" + }, + { + "cveId": "CVE-2026-114690", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114690", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114690.json", + "dateUpdated": "2026-11-11T14:04:00.142Z" + }, + { + "cveId": "CVE-2026-114691", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114691", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114691.json", + "dateUpdated": "2026-11-11T14:04:00.245Z" + }, + { + "cveId": "CVE-2026-115455", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115455", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115455.json", + "dateUpdated": "2026-11-11T14:04:00.225Z" + }, + { + "cveId": "CVE-2026-115456", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115456", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115456.json", + "dateUpdated": "2026-11-11T14:04:29.305Z" + }, + { + "cveId": "CVE-2026-32146", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32146", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32146.json", + "dateUpdated": "2026-11-11T14:13:44.294Z" + }, + { + "cveId": "CVE-2026-70399", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-70399", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70399.json", + "dateUpdated": "2026-11-11T14:07:28.956Z" + }, + { + "cveId": "CVE-2026-91000", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91000", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91000.json", + "dateUpdated": "2026-11-11T14:02:43.025Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T14:02:24.295Z", + "numberOfChanges": 15, + "new": [ + { + "cveId": "CVE-2026-123040", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123040", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123040.json", + "dateUpdated": "2026-11-11T14:00:01.991Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-105668", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105668", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105668.json", + "dateUpdated": "2026-11-11T14:02:17.237Z" + }, + { + "cveId": "CVE-2026-114690", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114690", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114690.json", + "dateUpdated": "2026-11-11T13:58:46.028Z" + }, + { + "cveId": "CVE-2026-114691", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114691", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114691.json", + "dateUpdated": "2026-11-11T13:58:47.420Z" + }, + { + "cveId": "CVE-2026-115455", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115455", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115455.json", + "dateUpdated": "2026-11-11T13:58:50.182Z" + }, + { + "cveId": "CVE-2026-115456", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115456", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115456.json", + "dateUpdated": "2026-11-11T13:59:26.426Z" + }, + { + "cveId": "CVE-2026-120286", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120286", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120286.json", + "dateUpdated": "2026-11-11T14:01:13.773Z" + }, + { + "cveId": "CVE-2026-120295", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120295", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120295.json", + "dateUpdated": "2026-11-11T14:00:26.627Z" + }, + { + "cveId": "CVE-2026-120730", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120730", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120730.json", + "dateUpdated": "2026-11-11T13:59:36.975Z" + }, + { + "cveId": "CVE-2026-120997", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120997", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120997.json", + "dateUpdated": "2026-11-11T13:59:03.563Z" + }, + { + "cveId": "CVE-2026-120999", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120999", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120999.json", + "dateUpdated": "2026-11-11T13:58:14.140Z" + }, + { + "cveId": "CVE-2026-121629", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121629", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121629.json", + "dateUpdated": "2026-11-11T13:58:59.979Z" + }, + { + "cveId": "CVE-2026-125879", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125879", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125879.json", + "dateUpdated": "2026-11-11T13:59:08.131Z" + }, + { + "cveId": "CVE-2026-48859", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-48859", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48859.json", + "dateUpdated": "2026-11-11T13:57:17.599Z" + }, + { + "cveId": "CVE-2026-86320", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86320", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86320.json", + "dateUpdated": "2026-11-11T13:59:07.143Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T13:56:44.298Z", + "numberOfChanges": 24, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-100236", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100236", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100236.json", + "dateUpdated": "2026-11-11T13:51:02.820Z" + }, + { + "cveId": "CVE-2026-119777", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119777", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119777.json", + "dateUpdated": "2026-11-11T13:51:31.269Z" + }, + { + "cveId": "CVE-2026-55951", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-55951", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55951.json", + "dateUpdated": "2026-11-11T13:56:27.286Z" + }, + { + "cveId": "CVE-2026-59696", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-59696", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59696.json", + "dateUpdated": "2026-11-11T13:55:48.756Z" + }, + { + "cveId": "CVE-2026-65634", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65634", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65634.json", + "dateUpdated": "2026-11-11T13:54:59.321Z" + }, + { + "cveId": "CVE-2026-66357", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-66357", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66357.json", + "dateUpdated": "2026-11-11T13:54:07.717Z" + }, + { + "cveId": "CVE-2026-66835", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-66835", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66835.json", + "dateUpdated": "2026-11-11T13:53:23.150Z" + }, + { + "cveId": "CVE-2026-68956", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68956", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68956.json", + "dateUpdated": "2026-11-11T13:52:35.726Z" + }, + { + "cveId": "CVE-2026-69664", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-69664", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/69xxx/CVE-2026-69664.json", + "dateUpdated": "2026-11-11T13:52:00.601Z" + }, + { + "cveId": "CVE-2026-84268", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84268", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84268.json", + "dateUpdated": "2026-11-11T13:55:56.972Z" + }, + { + "cveId": "CVE-2026-86561", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86561", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86561.json", + "dateUpdated": "2026-11-11T13:54:07.356Z" + }, + { + "cveId": "CVE-2026-86562", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86562", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86562.json", + "dateUpdated": "2026-11-11T13:50:48.994Z" + }, + { + "cveId": "CVE-2026-86563", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86563", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86563.json", + "dateUpdated": "2026-11-11T13:50:49.598Z" + }, + { + "cveId": "CVE-2026-86565", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86565", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86565.json", + "dateUpdated": "2026-11-11T13:50:54.233Z" + }, + { + "cveId": "CVE-2026-86566", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86566", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86566.json", + "dateUpdated": "2026-11-11T13:54:08.495Z" + }, + { + "cveId": "CVE-2026-86567", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86567", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86567.json", + "dateUpdated": "2026-11-11T13:50:56.346Z" + }, + { + "cveId": "CVE-2026-86845", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86845", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86845.json", + "dateUpdated": "2026-11-11T13:54:09.047Z" + }, + { + "cveId": "CVE-2026-86846", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86846", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86846.json", + "dateUpdated": "2026-11-11T13:54:12.081Z" + }, + { + "cveId": "CVE-2026-86847", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86847", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86847.json", + "dateUpdated": "2026-11-11T13:54:14.086Z" + }, + { + "cveId": "CVE-2026-86848", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86848", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86848.json", + "dateUpdated": "2026-11-11T13:51:01.613Z" + }, + { + "cveId": "CVE-2026-86849", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86849", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86849.json", + "dateUpdated": "2026-11-11T13:54:16.433Z" + }, + { + "cveId": "CVE-2026-86856", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86856", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86856.json", + "dateUpdated": "2026-11-11T13:54:16.443Z" + }, + { + "cveId": "CVE-2026-88924", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-88924", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88924.json", + "dateUpdated": "2026-11-11T13:56:00.052Z" + }, + { + "cveId": "CVE-2026-93683", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93683", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93683.json", + "dateUpdated": "2026-11-11T13:54:21.867Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T13:50:47.796Z", + "numberOfChanges": 36, + "new": [ + { + "cveId": "CVE-2026-125838", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125838", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125838.json", + "dateUpdated": "2026-11-11T13:47:25.465Z" + }, + { + "cveId": "CVE-2026-125839", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125839", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125839.json", + "dateUpdated": "2026-11-11T13:46:29.522Z" + }, + { + "cveId": "CVE-2026-125840", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125840", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125840.json", + "dateUpdated": "2026-11-11T13:46:00.406Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-105150", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105150", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105150.json", + "dateUpdated": "2026-11-11T13:49:19.498Z" + }, + { + "cveId": "CVE-2026-119097", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119097", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119097.json", + "dateUpdated": "2026-11-11T13:46:51.362Z" + }, + { + "cveId": "CVE-2026-121773", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121773", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121773.json", + "dateUpdated": "2026-11-11T13:45:32.169Z" + }, + { + "cveId": "CVE-2026-123473", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123473", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123473.json", + "dateUpdated": "2026-11-11T13:45:16.530Z" + }, + { + "cveId": "CVE-2026-123478", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123478", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123478.json", + "dateUpdated": "2026-11-11T13:47:25.725Z" + }, + { + "cveId": "CVE-2026-124250", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124250", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124250.json", + "dateUpdated": "2026-11-11T13:48:16.365Z" + }, + { + "cveId": "CVE-2026-124253", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124253", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124253.json", + "dateUpdated": "2026-11-11T13:47:08.627Z" + }, + { + "cveId": "CVE-2026-124256", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124256", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124256.json", + "dateUpdated": "2026-11-11T13:47:42.076Z" + }, + { + "cveId": "CVE-2026-124257", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124257", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124257.json", + "dateUpdated": "2026-11-11T13:47:59.651Z" + }, + { + "cveId": "CVE-2026-124752", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124752", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124752.json", + "dateUpdated": "2026-11-11T13:45:47.923Z" + }, + { + "cveId": "CVE-2026-125446", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125446", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125446.json", + "dateUpdated": "2026-11-11T13:49:27.147Z" + }, + { + "cveId": "CVE-2026-125451", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125451", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125451.json", + "dateUpdated": "2026-11-11T13:46:18.931Z" + }, + { + "cveId": "CVE-2026-125455", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125455", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125455.json", + "dateUpdated": "2026-11-11T13:46:03.282Z" + }, + { + "cveId": "CVE-2026-125761", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125761", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125761.json", + "dateUpdated": "2026-11-11T13:45:01.054Z" + }, + { + "cveId": "CVE-2026-125781", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125781", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125781.json", + "dateUpdated": "2026-11-11T13:46:34.367Z" + }, + { + "cveId": "CVE-2026-125784", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125784", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125784.json", + "dateUpdated": "2026-11-11T13:49:27.309Z" + }, + { + "cveId": "CVE-2026-125843", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125843", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125843.json", + "dateUpdated": "2026-11-11T13:46:47.119Z" + }, + { + "cveId": "CVE-2026-125844", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125844", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125844.json", + "dateUpdated": "2026-11-11T13:49:26.123Z" + }, + { + "cveId": "CVE-2026-125845", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125845", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125845.json", + "dateUpdated": "2026-11-11T13:49:26.275Z" + }, + { + "cveId": "CVE-2026-125846", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125846", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125846.json", + "dateUpdated": "2026-11-11T13:49:26.433Z" + }, + { + "cveId": "CVE-2026-125847", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125847", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125847.json", + "dateUpdated": "2026-11-11T13:47:56.953Z" + }, + { + "cveId": "CVE-2026-125848", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125848", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125848.json", + "dateUpdated": "2026-11-11T13:49:26.586Z" + }, + { + "cveId": "CVE-2026-125849", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125849", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125849.json", + "dateUpdated": "2026-11-11T13:49:26.773Z" + }, + { + "cveId": "CVE-2026-125850", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125850", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125850.json", + "dateUpdated": "2026-11-11T13:49:26.962Z" + }, + { + "cveId": "CVE-2026-12424", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12424", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12424.json", + "dateUpdated": "2026-11-11T13:48:48.121Z" + }, + { + "cveId": "CVE-2026-12427", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12427", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12427.json", + "dateUpdated": "2026-11-11T13:48:32.553Z" + }, + { + "cveId": "CVE-2026-15785", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15785", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15785.json", + "dateUpdated": "2026-11-11T13:49:04.324Z" + }, + { + "cveId": "CVE-2026-70405", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-70405", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70405.json", + "dateUpdated": "2026-11-11T13:50:14.473Z" + }, + { + "cveId": "CVE-2026-70409", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-70409", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70409.json", + "dateUpdated": "2026-11-11T13:48:47.878Z" + }, + { + "cveId": "CVE-2026-71380", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-71380", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71380.json", + "dateUpdated": "2026-11-11T13:47:09.255Z" + }, + { + "cveId": "CVE-2026-74835", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-74835", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74835.json", + "dateUpdated": "2026-11-11T13:45:05.856Z" + }, + { + "cveId": "CVE-2026-74994", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-74994", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74994.json", + "dateUpdated": "2026-11-11T13:45:44.238Z" + }, + { + "cveId": "CVE-2026-93427", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93427", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93427.json", + "dateUpdated": "2026-11-11T13:49:35.913Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T13:44:49.136Z", + "numberOfChanges": 19, + "new": [ + { + "cveId": "CVE-2026-125841", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125841", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125841.json", + "dateUpdated": "2026-11-11T13:44:07.649Z" + }, + { + "cveId": "CVE-2026-125842", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125842", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125842.json", + "dateUpdated": "2026-11-11T13:39:46.944Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-121770", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121770", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121770.json", + "dateUpdated": "2026-11-11T13:43:13.772Z" + }, + { + "cveId": "CVE-2026-123480", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123480", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123480.json", + "dateUpdated": "2026-11-11T13:42:47.382Z" + }, + { + "cveId": "CVE-2026-124263", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124263", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124263.json", + "dateUpdated": "2026-11-11T13:41:25.754Z" + }, + { + "cveId": "CVE-2026-124411", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124411", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124411.json", + "dateUpdated": "2026-11-11T13:44:26.951Z" + }, + { + "cveId": "CVE-2026-125045", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125045", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125045.json", + "dateUpdated": "2026-11-11T13:44:11.544Z" + }, + { + "cveId": "CVE-2026-125433", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125433", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125433.json", + "dateUpdated": "2026-11-11T13:43:22.830Z" + }, + { + "cveId": "CVE-2026-125445", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125445", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125445.json", + "dateUpdated": "2026-11-11T13:42:56.420Z" + }, + { + "cveId": "CVE-2026-125450", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125450", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125450.json", + "dateUpdated": "2026-11-11T13:43:38.319Z" + }, + { + "cveId": "CVE-2026-125454", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125454", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125454.json", + "dateUpdated": "2026-11-11T13:42:31.161Z" + }, + { + "cveId": "CVE-2026-125680", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125680", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125680.json", + "dateUpdated": "2026-11-11T13:44:43.831Z" + }, + { + "cveId": "CVE-2026-125708", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125708", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125708.json", + "dateUpdated": "2026-11-11T13:42:15.014Z" + }, + { + "cveId": "CVE-2026-125743", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125743", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125743.json", + "dateUpdated": "2026-11-11T13:43:05.673Z" + }, + { + "cveId": "CVE-2026-125762", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125762", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125762.json", + "dateUpdated": "2026-11-11T13:43:54.529Z" + }, + { + "cveId": "CVE-2026-71562", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-71562", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71562.json", + "dateUpdated": "2026-11-11T13:42:41.581Z" + }, + { + "cveId": "CVE-2026-73270", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-73270", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73270.json", + "dateUpdated": "2026-11-11T13:43:13.939Z" + }, + { + "cveId": "CVE-2026-73276", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-73276", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73276.json", + "dateUpdated": "2026-11-11T13:44:01.526Z" + }, + { + "cveId": "CVE-2026-73812", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-73812", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73812.json", + "dateUpdated": "2026-11-11T13:44:38.119Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T13:38:47.106Z", + "numberOfChanges": 7, + "new": [], + "updated": [ + { + "cveId": "CVE-2026-74835", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-74835", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74835.json", + "dateUpdated": "2026-11-11T13:37:32.801Z" + }, + { + "cveId": "CVE-2026-74994", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-74994", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74994.json", + "dateUpdated": "2026-11-11T13:36:41.675Z" + }, + { + "cveId": "CVE-2026-75538", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75538", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75538.json", + "dateUpdated": "2026-11-11T13:34:33.003Z" + }, + { + "cveId": "CVE-2026-96275", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96275", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96275.json", + "dateUpdated": "2026-11-11T13:37:25.264Z" + }, + { + "cveId": "CVE-2026-96280", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96280", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96280.json", + "dateUpdated": "2026-11-11T13:37:39.770Z" + }, + { + "cveId": "CVE-2026-97023", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97023", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97023.json", + "dateUpdated": "2026-11-11T13:37:38.246Z" + }, + { + "cveId": "CVE-2026-97024", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97024", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97024.json", + "dateUpdated": "2026-11-11T13:37:39.155Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T13:32:34.130Z", + "numberOfChanges": 7, + "new": [ + { + "cveId": "CVE-2026-0470", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0470", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0470.json", + "dateUpdated": "2026-11-11T13:27:10.327Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-123478", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123478", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123478.json", + "dateUpdated": "2026-11-11T13:30:15.870Z" + }, + { + "cveId": "CVE-2026-125843", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125843", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125843.json", + "dateUpdated": "2026-11-11T13:27:17.383Z" + }, + { + "cveId": "CVE-2026-125844", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125844", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125844.json", + "dateUpdated": "2026-11-11T13:26:35.307Z" + }, + { + "cveId": "CVE-2026-81856", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81856", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81856.json", + "dateUpdated": "2026-11-11T13:31:44.405Z" + }, + { + "cveId": "CVE-2026-96612", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96612", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96612.json", + "dateUpdated": "2026-11-11T13:28:28.140Z" + }, + { + "cveId": "CVE-2026-96618", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96618", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96618.json", + "dateUpdated": "2026-11-11T13:27:29.636Z" + } + ], + "error": [] + }, + { + "fetchTime": "2026-11-11T13:26:32.589Z", + "numberOfChanges": 9, + "new": [ + { + "cveId": "CVE-2026-125843", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125843", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125843.json", + "dateUpdated": "2026-11-11T13:26:31.928Z" + }, + { + "cveId": "CVE-2026-125844", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125844", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125844.json", + "dateUpdated": "2026-11-11T13:25:35.957Z" + }, + { + "cveId": "CVE-2026-125845", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125845", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125845.json", + "dateUpdated": "2026-11-11T13:25:45.232Z" + }, + { + "cveId": "CVE-2026-125846", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125846", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125846.json", + "dateUpdated": "2026-11-11T13:24:58.995Z" + }, + { + "cveId": "CVE-2026-125847", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125847", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125847.json", + "dateUpdated": "2026-11-11T13:24:25.334Z" + }, + { + "cveId": "CVE-2026-125848", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125848", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125848.json", + "dateUpdated": "2026-11-11T13:23:44.575Z" + }, + { + "cveId": "CVE-2026-125849", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125849", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125849.json", + "dateUpdated": "2026-11-11T13:21:30.312Z" + }, + { + "cveId": "CVE-2026-49236", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-49236", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49236.json", + "dateUpdated": "2026-11-11T13:23:38.353Z" + } + ], + "updated": [ + { + "cveId": "CVE-2026-74860", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-74860", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74860.json", + "dateUpdated": "2026-11-11T13:22:48.574Z" + } + ], + "error": [] + }, { "fetchTime": "2026-11-11T13:20:32.783Z", "numberOfChanges": 3, @@ -841401,233 +842232,5 @@ } ], "error": [] - }, - { - "fetchTime": "2026-10-12T14:07:29.364Z", - "numberOfChanges": 16, - "new": [ - { - "cveId": "CVE-2026-108894", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108894", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108894.json", - "dateUpdated": "2026-10-12T14:00:15.516Z" - }, - { - "cveId": "CVE-2026-109225", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109225", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109225.json", - "dateUpdated": "2026-10-12T14:04:29.986Z" - }, - { - "cveId": "CVE-2026-109226", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109226", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109226.json", - "dateUpdated": "2026-10-12T14:04:30.674Z" - }, - { - "cveId": "CVE-2026-109227", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109227", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109227.json", - "dateUpdated": "2026-10-12T14:04:31.362Z" - }, - { - "cveId": "CVE-2026-109228", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109228", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109228.json", - "dateUpdated": "2026-10-12T14:04:32.029Z" - }, - { - "cveId": "CVE-2026-109229", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109229", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109229.json", - "dateUpdated": "2026-10-12T14:04:32.719Z" - }, - { - "cveId": "CVE-2026-12613", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12613", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12613.json", - "dateUpdated": "2026-10-12T14:01:38.527Z" - }, - { - "cveId": "CVE-2026-18390", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18390", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18390.json", - "dateUpdated": "2026-10-12T13:57:33.532Z" - }, - { - "cveId": "CVE-2026-68764", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68764", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68764.json", - "dateUpdated": "2026-10-12T13:51:32.992Z" - } - ], - "updated": [ - { - "cveId": "CVE-2026-21114", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-21114", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21114.json", - "dateUpdated": "2026-10-12T14:02:28.661Z" - }, - { - "cveId": "CVE-2026-21120", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-21120", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21120.json", - "dateUpdated": "2026-10-12T14:00:51.252Z" - }, - { - "cveId": "CVE-2026-21122", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-21122", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21122.json", - "dateUpdated": "2026-10-12T14:02:03.974Z" - }, - { - "cveId": "CVE-2026-21124", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-21124", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21124.json", - "dateUpdated": "2026-10-12T14:04:09.971Z" - }, - { - "cveId": "CVE-2026-21125", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-21125", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21125.json", - "dateUpdated": "2026-10-12T14:05:40.264Z" - }, - { - "cveId": "CVE-2026-21137", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-21137", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21137.json", - "dateUpdated": "2026-10-12T13:55:19.109Z" - }, - { - "cveId": "CVE-2026-95594", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95594", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95594.json", - "dateUpdated": "2026-10-12T14:07:16.423Z" - } - ], - "error": [] - }, - { - "fetchTime": "2026-10-12T13:49:19.900Z", - "numberOfChanges": 19, - "new": [ - { - "cveId": "CVE-2026-103502", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103502", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103502.json", - "dateUpdated": "2026-10-12T13:15:29.040Z" - }, - { - "cveId": "CVE-2026-108890", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108890", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108890.json", - "dateUpdated": "2026-10-12T13:15:12.781Z" - }, - { - "cveId": "CVE-2026-108892", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108892", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108892.json", - "dateUpdated": "2026-10-12T13:30:16.430Z" - }, - { - "cveId": "CVE-2026-108893", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108893", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108893.json", - "dateUpdated": "2026-10-12T13:45:15.796Z" - }, - { - "cveId": "CVE-2026-109169", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109169", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109169.json", - "dateUpdated": "2026-10-12T13:39:41.214Z" - }, - { - "cveId": "CVE-2026-109170", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109170", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109170.json", - "dateUpdated": "2026-10-12T13:39:41.904Z" - }, - { - "cveId": "CVE-2026-109199", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109199", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109199.json", - "dateUpdated": "2026-10-12T13:39:42.546Z" - }, - { - "cveId": "CVE-2026-109200", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109200", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109200.json", - "dateUpdated": "2026-10-12T13:39:43.259Z" - }, - { - "cveId": "CVE-2026-109201", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109201", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109201.json", - "dateUpdated": "2026-10-12T13:39:43.919Z" - }, - { - "cveId": "CVE-2026-109202", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109202", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109202.json", - "dateUpdated": "2026-10-12T13:39:44.572Z" - }, - { - "cveId": "CVE-2026-109203", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109203", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109203.json", - "dateUpdated": "2026-10-12T13:39:45.258Z" - }, - { - "cveId": "CVE-2026-109204", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109204", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109204.json", - "dateUpdated": "2026-10-12T13:39:45.921Z" - }, - { - "cveId": "CVE-2026-109205", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109205", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109205.json", - "dateUpdated": "2026-10-12T13:39:47.270Z" - }, - { - "cveId": "CVE-2026-109206", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109206", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109206.json", - "dateUpdated": "2026-10-12T13:39:47.896Z" - } - ], - "updated": [ - { - "cveId": "CVE-2021-47796", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-47796", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/47xxx/CVE-2021-47796.json", - "dateUpdated": "2026-10-12T13:33:34.726Z" - }, - { - "cveId": "CVE-2021-4469", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-4469", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/4xxx/CVE-2021-4469.json", - "dateUpdated": "2026-10-12T13:32:56.854Z" - }, - { - "cveId": "CVE-2026-104082", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104082", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104082.json", - "dateUpdated": "2026-10-12T13:37:14.646Z" - }, - { - "cveId": "CVE-2026-104083", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104083", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104083.json", - "dateUpdated": "2026-10-12T13:37:48.267Z" - }, - { - "cveId": "CVE-2026-104084", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104084", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104084.json", - "dateUpdated": "2026-10-12T13:38:12.686Z" - } - ], - "error": [] } ] \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 082bc032a3..a09f6a3e12 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,7 +1,7 @@ { "source": "https://github.com/CVEProject/cvelistV5.git", - "upstream_commit": "6644e39b576fca9a55ad2999e9517ca74bff78da", + "upstream_commit": "3db3907f646876f32f8043ad5e99ff6eea472625", "since_year": 2017, - "records": 330988, - "synced_at_utc": "2026-11-11T13:33:43.757573+00:00" + "records": 331003, + "synced_at_utc": "2026-11-11T14:34:11.016920+00:00" }