VULN/vuln-cve
1
0
Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-11T15:45:26Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-11 16:45:32 +01:00
parent 629b6d7aad
commit 6b4b3fcc10
72 changed files with 5426 additions and 674 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/2023/4xxx/CVE-2023-4570.json
+65 -65
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-4570",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,41 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2023-08-28T19:32:41.324Z",
"datePublished": "2023-10-05T15:26:45.467Z",
"dateUpdated": "2024-09-19T18:53:34.207Z"
"dateUpdated": "2026-11-11T14:39:48.025Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T14:39:48.025Z"
},
"title": "Improper Restriction in NI MeasurementLink Python Services",
"problemTypes": [
{
"defaultStatus": "unaffected",
"modules": [
"Python Services"
],
"product": "MeasurementLink ",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "1.1.1"
"lang": "en",
"cweId": "CWE-420",
"description": "CWE-420 Unprotected Alternate Channel",
"type": "CWE"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the </span><span style=\"background-color: rgb(255, 255, 255);\">ni-measurementlink-service</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;Python package and all previous versions.</span><br>"
}
],
"value": "An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
@@ -54,57 +41,70 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "MeasurementLink",
"modules": [
"Python Services"
],
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThanOrEqual": "1.1.0",
"versionType": "1.1.1"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 and all previous versions of the ni-measurementlink-service Python package.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0&nbsp;</span>and all previous versions&nbsp;<span>of the </span><span>ni-measurementlink-service</span><span>&nbsp;Python package.</span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/documentation/supplemental/23/improper-restriction-in-ni-measurementlink-python-services.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-420",
"description": "CWE-420 Unprotected Alternate Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2023-10-05T15:26:45.467Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/documentation/supplemental/23/improper-restriction-in-ni-measurementlink-python-services.html"
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper Restriction in NI MeasurementLink Python Services",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
data/2025/2xxx/CVE-2025-2630.json
+119 -118
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-2630",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,66 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2025-03-21T21:07:31.428Z",
"datePublished": "2025-04-09T18:50:05.849Z",
"dateUpdated": "2025-04-09T18:57:44.369Z"
"dateUpdated": "2026-11-11T14:52:06.888Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T14:52:06.888Z"
},
"title": "DLL Hijacking Vulnerability in NI LabVIEW",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "LabVIEW",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThan": "22.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "23.3.5",
"status": "affected",
"version": "23.1.0",
"versionType": "semver"
},
{
"lessThan": "224.3.2",
"status": "affected",
"version": "24.1.0",
"versionType": "semver"
},
{
"lessThan": "25.1.1",
"status": "affected",
"version": "25.1.0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mike Palafox from BLOOMY®"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.</span><br>"
}
],
"value": "There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-471",
@@ -79,89 +41,128 @@
]
}
],
"metrics": [
"affected": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
"vendor": "NI",
"product": "LabVIEW",
"platforms": [
"Windows"
],
"versions": [
{
"lang": "en",
"value": "GENERAL"
"status": "affected",
"version": "0",
"lessThan": "22.3.4",
"versionType": "semver"
},
{
"status": "affected",
"version": "23.1.0",
"lessThan": "23.3.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "24.1.0",
"lessThan": "24.3.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "25.1.0",
"lessThan": "25.1.1",
"versionType": "semver"
}
]
},
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
"lang": "en",
"value": "There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.",
"supportingMedia": [
{
"lang": "en",
"value": "GENERAL"
"type": "text/html",
"base64": false,
"value": "<span>There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.</span><br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2025-04-09T18:50:05.849Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dll-hijacking-vulnerability-in-ni-labview.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.3,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
}
],
"credits": [
{
"lang": "en",
"value": "Mike Palafox from BLOOMY®",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DLL Hijacking Vulnerability in NI LabVIEW",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2026/102xxx/CVE-2026-102589.json
+171
View File
@@ -0,0 +1,171 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-102589",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-09-29T14:13:30.774Z",
"datePublished": "2026-11-11T15:03:07.435Z",
"dateUpdated": "2026-11-11T15:03:07.435Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.14",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.14",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:03:07.435Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-102589"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Cross-instance user impersonation through image renderer JWTs"
}
}
}
data/2026/106xxx/CVE-2026-106023.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-106023",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-06T12:48:04.655Z",
"datePublished": "2026-11-11T14:55:26.491Z",
"dateUpdated": "2026-11-11T14:55:26.491Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T14:55:26.491Z"
},
"title": "Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-476 NULL pointer dereference",
"lang": "en",
"cweId": "CWE-476",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache HTTP Server",
"versions": [
{
"status": "affected",
"version": "2.4.30",
"lessThanOrEqual": "2.4.70",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"value": "NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.</p><p>This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.</p>"
}
]
}
],
"references": [
{
"url": "https://httpd.apache.org/security/vulnerabilities_24.html",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "important"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"timeline": [
{
"time": "2026-09-29T12:00:00.000Z",
"lang": "en",
"value": "reported"
}
],
"credits": [
{
"lang": "en",
"value": "hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability Research Institute, working with 360 TuLongFeng.",
"type": "finder"
},
{
"lang": "en",
"value": "Lucian Nitescu",
"type": "finder"
},
{
"lang": "en",
"value": "Bartlomiej Dmitruk at striga.ai",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/107xxx/CVE-2026-107509.json
+142
View File
@@ -0,0 +1,142 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-107509",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-08T09:32:51.742Z",
"datePublished": "2026-11-11T15:02:06.763Z",
"dateUpdated": "2026-11-11T15:02:06.763Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lucifer_"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:02:06.763Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-107509"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Memory exhaustion denial of service in SQL Expressions"
}
}
}
data/2026/109xxx/CVE-2026-109163.json
+127
View File
@@ -0,0 +1,127 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-109163",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-12T12:32:36.766Z",
"datePublished": "2026-11-11T14:55:08.116Z",
"dateUpdated": "2026-11-11T14:55:08.116Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T14:55:08.116Z"
},
"title": "Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"cweId": "CWE-121",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache HTTP Server",
"versions": [
{
"status": "affected",
"version": "2.4.69",
"lessThanOrEqual": "2.4.70",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"value": "Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)\n\n\n\nThis issue affects Apache HTTP Server: 2.4.69.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after&nbsp;CVE-2026-63292)</p><p>This issue affects Apache HTTP Server: 2.4.69.</p>"
}
]
}
],
"references": [
{
"url": "https://httpd.apache.org/security/vulnerabilities_24.html",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "low"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"timeline": [
{
"time": "2026-10-05T12:00:00.000Z",
"lang": "en",
"value": "reported"
}
],
"credits": [
{
"lang": "en",
"value": "Gustavo Aiello",
"type": "finder"
},
{
"lang": "en",
"value": "Charles Vosburgh (the-vibe-dev)",
"type": "finder"
},
{
"lang": "en",
"value": "Wojciech Tatarski (CloudLinux / TuxCare)",
"type": "finder"
},
{
"lang": "en",
"value": "Oz Kaiser (@tatikoma)",
"type": "finder"
},
{
"lang": "en",
"value": "Daisuke Hatakeyama (SYZD Research)",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/110xxx/CVE-2026-110289.json
+103
View File
@@ -0,0 +1,103 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-110289",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-13T19:42:09.015Z",
"datePublished": "2026-11-11T15:03:27.711Z",
"dateUpdated": "2026-11-11T15:03:27.711Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:03:27.711Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-110289"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Git Sync connections send credentials to unvalidated server URLs"
}
}
}
data/2026/110xxx/CVE-2026-110992.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-110992",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-15T12:03:38.348Z",
"datePublished": "2026-11-11T15:01:46.486Z",
"dateUpdated": "2026-11-11T15:01:46.486Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "velvelvel"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:01:46.486Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-110992"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Path traversal in Git Sync delete and move jobs"
}
}
}
data/2026/111xxx/CVE-2026-111000.json
+120
View File
@@ -0,0 +1,120 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-111000",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-15T12:04:35.464Z",
"datePublished": "2026-11-11T15:02:26.998Z",
"dateUpdated": "2026-11-11T15:02:26.998Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.14",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.10",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.14",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.10",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hdwsec"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:02:26.998Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-111000"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Privilege escalation through folder move in the folders API"
}
}
}
data/2026/111xxx/CVE-2026-111024.json
+154
View File
@@ -0,0 +1,154 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-111024",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-10-15T12:06:48.757Z",
"datePublished": "2026-11-11T15:02:47.099Z",
"dateUpdated": "2026-11-11T15:02:47.099Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "naxxan1337"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:02:47.099Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-111024"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Folder permission bypass in the Git Sync repository files API"
}
}
}
data/2026/119xxx/CVE-2026-119618.json
+112
View File
@@ -0,0 +1,112 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-119618",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-10-30T12:32:13.904Z",
"datePublished": "2026-11-11T14:54:08.155Z",
"dateUpdated": "2026-11-11T14:54:08.155Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T14:54:08.155Z"
},
"title": "Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"cweId": "CWE-362",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache HTTP Server",
"versions": [
{
"status": "affected",
"version": "2.4.55",
"lessThanOrEqual": "2.4.70",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"value": "Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.<br><span><br>This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.<br></span><span>Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.</span></p>"
}
]
}
],
"references": [
{
"url": "https://httpd.apache.org/security/vulnerabilities_24.html",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "critical"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"timeline": [
{
"time": "2026-10-26T12:00:00.000Z",
"lang": "en",
"value": "reported"
}
],
"credits": [
{
"lang": "en",
"value": "Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ",
"type": "finder"
},
{
"lang": "en",
"value": "Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research",
"type": "finder"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/121xxx/CVE-2026-121014.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T08:16:22.819Z",
"datePublished": "2026-11-11T11:48:21.956Z",
"dateUpdated": "2026-11-11T11:49:23.122Z"
"dateUpdated": "2026-11-11T15:12:51.144Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:00:26.830138Z",
"id": "CVE-2026-121014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:12:51.144Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121028.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T09:15:33.405Z",
"datePublished": "2026-11-11T11:55:40.977Z",
"dateUpdated": "2026-11-11T11:56:43.854Z"
"dateUpdated": "2026-11-11T15:12:18.443Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:00:48.080585Z",
"id": "CVE-2026-121028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:12:18.443Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121574.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-03T15:25:04.394Z",
"datePublished": "2026-11-11T11:54:58.331Z",
"dateUpdated": "2026-11-11T11:55:59.322Z"
"dateUpdated": "2026-11-11T15:12:34.065Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:00:40.347738Z",
"id": "CVE-2026-121574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:12:34.065Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121663.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-11-03T18:52:08.480Z",
"datePublished": "2026-11-10T18:23:55.977Z",
"dateUpdated": "2026-11-11T11:50:45.459Z"
"dateUpdated": "2026-11-11T15:06:27.495Z"
},
"containers": {
"cna": {
@@ -96,6 +96,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:06:19.833697Z",
"id": "CVE-2026-121663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:06:27.495Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121665.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-11-03T18:52:08.480Z",
"datePublished": "2026-11-10T18:21:57.865Z",
"dateUpdated": "2026-11-11T11:48:49.835Z"
"dateUpdated": "2026-11-11T15:07:01.946Z"
},
"containers": {
"cna": {
@@ -96,6 +96,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:06:53.300107Z",
"id": "CVE-2026-121665",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:07:01.946Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121668.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-11-03T18:52:08.480Z",
"datePublished": "2026-11-10T18:21:58.378Z",
"dateUpdated": "2026-11-11T11:48:50.349Z"
"dateUpdated": "2026-11-11T15:06:44.002Z"
},
"containers": {
"cna": {
@@ -99,6 +99,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:06:35.660954Z",
"id": "CVE-2026-121668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:06:44.002Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121680.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-11-03T18:52:08.481Z",
"datePublished": "2026-11-10T18:24:01.333Z",
"dateUpdated": "2026-11-11T11:50:50.855Z"
"dateUpdated": "2026-11-11T15:06:05.247Z"
},
"containers": {
"cna": {
@@ -445,6 +445,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:05:54.177742Z",
"id": "CVE-2026-121680",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:06:05.247Z"
}
}
]
}
}
data/2026/122xxx/CVE-2026-122164.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-11-04T19:07:32.304Z",
"datePublished": "2026-11-10T18:24:03.492Z",
"dateUpdated": "2026-11-11T11:50:53.525Z"
"dateUpdated": "2026-11-11T15:05:44.674Z"
},
"containers": {
"cna": {
@@ -445,6 +445,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:05:34.682130Z",
"id": "CVE-2026-122164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:05:44.674Z"
}
}
]
}
}
data/2026/122xxx/CVE-2026-122169.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-11-04T19:07:32.305Z",
"datePublished": "2026-11-10T18:24:06.041Z",
"dateUpdated": "2026-11-11T11:50:56.158Z"
"dateUpdated": "2026-11-11T15:05:26.222Z"
},
"containers": {
"cna": {
@@ -445,6 +445,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:05:17.915613Z",
"id": "CVE-2026-122169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:05:26.222Z"
}
}
]
}
}
data/2026/122xxx/CVE-2026-122177.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "microsoft",
"dateReserved": "2026-11-04T19:07:32.305Z",
"datePublished": "2026-11-10T18:24:10.890Z",
"dateUpdated": "2026-11-11T11:51:00.673Z"
"dateUpdated": "2026-11-11T15:05:09.787Z"
},
"containers": {
"cna": {
@@ -445,6 +445,40 @@
}
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:04:58.484306Z",
"id": "CVE-2026-122177",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:05:09.787Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123040.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Kaspersky",
"dateReserved": "2026-11-05T07:33:05.167Z",
"datePublished": "2026-11-11T14:00:01.991Z",
"dateUpdated": "2026-11-11T14:00:01.991Z"
"dateUpdated": "2026-11-11T14:15:36.255Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
]
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T14:15:27.397847Z",
"id": "CVE-2026-123040",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T14:15:36.255Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123481.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-06T00:25:34.013Z",
"datePublished": "2026-11-11T12:40:46.952Z",
"dateUpdated": "2026-11-11T12:41:46.288Z"
"dateUpdated": "2026-11-11T15:07:40.974Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:43.419292Z",
"id": "CVE-2026-123481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:07:40.974Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123710.json
+147
View File
@@ -0,0 +1,147 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123710",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-06T10:23:55.509Z",
"datePublished": "2026-11-11T15:02:31.341Z",
"dateUpdated": "2026-11-11T15:02:31.341Z"
},
"containers": {
"cna": {
"title": "Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation",
"metrics": [
{
"other": {
"content": {
"value": "Critical",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quay/quay-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:quay:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quay/quay-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:quay:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Quay 5",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quay/quay-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:quay:5"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-123710",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568072",
"name": "RHBZ#2568072",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-11T14:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1287",
"description": "Improper Validation of Specified Type of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-1287: Improper Validation of Specified Type of Input",
"workarounds": [
{
"lang": "en",
"value": "Restrict access to the /keys endpoint at the proxy or load balancer so only trusted internal components can reach it. Review audit logs for service_key_rotate and service_key_delete events with a null expiration_date, and remove any unrecognised approved service keys. Deleting a rogue key is not durable until a fixed build is deployed, because the anonymous request can install a new key."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T09:44:27.114Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-11T14:00:00.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Dave O'Connor (Red Hat)."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T15:02:31.341Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/124xxx/CVE-2026-124255.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-11T12:00:27.184Z",
"dateUpdated": "2026-11-11T12:01:28.556Z"
"dateUpdated": "2026-11-11T15:11:31.322Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:10.310009Z",
"id": "CVE-2026-124255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:11:31.322Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124261.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-11T12:37:06.142Z",
"dateUpdated": "2026-11-11T12:38:08.129Z"
"dateUpdated": "2026-11-11T15:09:18.796Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:05.979932Z",
"id": "CVE-2026-124261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:09:18.796Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124262.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-11T12:06:42.710Z",
"dateUpdated": "2026-11-11T12:07:45.699Z"
"dateUpdated": "2026-11-11T15:10:59.630Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:22.460664Z",
"id": "CVE-2026-124262",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:10:59.630Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124269.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-07T00:30:09.635Z",
"datePublished": "2026-11-11T12:07:04.363Z",
"dateUpdated": "2026-11-11T12:08:05.317Z"
"dateUpdated": "2026-11-11T15:10:43.528Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:28.100030Z",
"id": "CVE-2026-124269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:10:43.528Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124416.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-11T12:38:52.064Z",
"dateUpdated": "2026-11-11T12:39:52.258Z"
"dateUpdated": "2026-11-11T15:08:29.559Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:25.069980Z",
"id": "CVE-2026-124416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:08:29.559Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124417.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-11T12:07:59.222Z",
"dateUpdated": "2026-11-11T12:09:00.883Z"
"dateUpdated": "2026-11-11T15:10:27.257Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:34.893359Z",
"id": "CVE-2026-124417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:10:27.257Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124421.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.331Z",
"datePublished": "2026-11-11T12:01:13.331Z",
"dateUpdated": "2026-11-11T12:06:18.017Z"
"dateUpdated": "2026-11-11T15:11:15.851Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:16.403998Z",
"id": "CVE-2026-124421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:11:15.851Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124746.json
+137
View File
@@ -0,0 +1,137 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124746",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.479Z",
"datePublished": "2026-11-11T15:03:07.440Z",
"dateUpdated": "2026-11-11T15:03:07.440Z"
},
"containers": {
"cna": {
"title": "Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound",
"metrics": [
{
"other": {
"content": {
"value": "Moderate",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "busybox",
"defaultStatus": "unknown",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "busybox",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-124746",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571675",
"name": "RHBZ#2571675",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-11-11T09:15:15.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T13:41:02.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-11T09:15:15.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T15:03:07.440Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/124xxx/CVE-2026-124753.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T11:58:43.395Z",
"datePublished": "2026-11-11T11:57:51.190Z",
"dateUpdated": "2026-11-11T11:57:51.689Z"
"dateUpdated": "2026-11-11T15:11:47.464Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:02.810906Z",
"id": "CVE-2026-124753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:11:47.464Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125046.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-09T16:21:10.516Z",
"datePublished": "2026-11-11T13:02:24.506Z",
"dateUpdated": "2026-11-11T13:02:44.252Z"
"dateUpdated": "2026-11-11T15:06:16.899Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:18.683408Z",
"id": "CVE-2026-125046",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:06:16.899Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125431.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.520Z",
"datePublished": "2026-11-11T12:37:36.519Z",
"dateUpdated": "2026-11-11T12:37:38.047Z"
"dateUpdated": "2026-11-11T15:09:02.494Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:14.281952Z",
"id": "CVE-2026-125431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:09:02.494Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125435.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.521Z",
"datePublished": "2026-11-11T12:09:56.241Z",
"dateUpdated": "2026-11-11T12:10:57.115Z"
"dateUpdated": "2026-11-11T15:10:10.945Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:46.575046Z",
"id": "CVE-2026-125435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:10:10.945Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125436.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.521Z",
"datePublished": "2026-11-11T12:39:38.057Z",
"dateUpdated": "2026-11-11T12:40:37.418Z"
"dateUpdated": "2026-11-11T15:08:12.885Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:31.070393Z",
"id": "CVE-2026-125436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:08:12.885Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125437.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.521Z",
"datePublished": "2026-11-11T11:56:14.907Z",
"dateUpdated": "2026-11-11T11:57:15.525Z"
"dateUpdated": "2026-11-11T15:12:02.981Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:00:54.293462Z",
"id": "CVE-2026-125437",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:12:02.981Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125448.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.522Z",
"datePublished": "2026-11-11T12:41:11.637Z",
"dateUpdated": "2026-11-11T12:42:13.229Z"
"dateUpdated": "2026-11-11T15:07:24.388Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:49.686042Z",
"id": "CVE-2026-125448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:07:24.388Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125746.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:29:24.878Z",
"datePublished": "2026-11-11T13:00:40.487Z",
"dateUpdated": "2026-11-11T13:01:42.976Z"
"dateUpdated": "2026-11-11T15:06:32.648Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:13.353887Z",
"id": "CVE-2026-125746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:06:32.648Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125763.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.981Z",
"datePublished": "2026-11-11T12:40:25.056Z",
"dateUpdated": "2026-11-11T12:41:27.183Z"
"dateUpdated": "2026-11-11T15:07:56.635Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:38.184752Z",
"id": "CVE-2026-125763",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:07:56.635Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125766.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.982Z",
"datePublished": "2026-11-11T12:42:38.734Z",
"dateUpdated": "2026-11-11T12:52:52.747Z"
"dateUpdated": "2026-11-11T15:07:05.321Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:56.167911Z",
"id": "CVE-2026-125766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:07:05.321Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125767.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.982Z",
"datePublished": "2026-11-11T12:53:23.741Z",
"dateUpdated": "2026-11-11T12:54:24.794Z"
"dateUpdated": "2026-11-11T15:06:48.807Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:02.967052Z",
"id": "CVE-2026-125767",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:06:48.807Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125776.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.983Z",
"datePublished": "2026-11-11T12:36:04.025Z",
"dateUpdated": "2026-11-11T12:36:32.411Z"
"dateUpdated": "2026-11-11T15:09:34.839Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:58.393319Z",
"id": "CVE-2026-125776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:09:34.839Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125778.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.983Z",
"datePublished": "2026-11-11T12:38:33.446Z",
"dateUpdated": "2026-11-11T12:39:34.805Z"
"dateUpdated": "2026-11-11T15:08:46.964Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:02:19.565444Z",
"id": "CVE-2026-125778",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:08:46.964Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125782.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.983Z",
"datePublished": "2026-11-11T12:10:50.961Z",
"dateUpdated": "2026-11-11T12:11:51.035Z"
"dateUpdated": "2026-11-11T15:09:51.270Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:01:51.403079Z",
"id": "CVE-2026-125782",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:09:51.270Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125838.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-11T13:47:25.031Z",
"dateUpdated": "2026-11-11T13:47:25.465Z"
"dateUpdated": "2026-11-11T15:04:51.234Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:46.641167Z",
"id": "CVE-2026-125838",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:04:51.234Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125839.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-11T13:46:29.120Z",
"dateUpdated": "2026-11-11T13:46:29.522Z"
"dateUpdated": "2026-11-11T15:05:10.463Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:40.100733Z",
"id": "CVE-2026-125839",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:05:10.463Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125840.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-11T13:44:59.478Z",
"dateUpdated": "2026-11-11T13:46:00.406Z"
"dateUpdated": "2026-11-11T15:05:26.455Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:34.996871Z",
"id": "CVE-2026-125840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:05:26.455Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125841.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-11T13:44:01.109Z",
"dateUpdated": "2026-11-11T13:44:07.649Z"
"dateUpdated": "2026-11-11T15:05:44.439Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:28.595635Z",
"id": "CVE-2026-125841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:05:44.439Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125842.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.991Z",
"datePublished": "2026-11-11T13:39:46.424Z",
"dateUpdated": "2026-11-11T13:39:46.944Z"
"dateUpdated": "2026-11-11T15:06:00.860Z"
},
"containers": {
"cna": {
@@ -115,6 +115,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T15:03:22.880802Z",
"id": "CVE-2026-125842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T15:06:00.860Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125883.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "N-able",
"dateReserved": "2026-11-10T12:55:13.170Z",
"datePublished": "2026-11-10T21:19:11.273Z",
"dateUpdated": "2026-11-10T21:19:11.273Z"
"dateUpdated": "2026-11-11T14:49:36.853Z"
},
"containers": {
"cna": {
@@ -118,6 +118,48 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able#anonymous-service-import-xxe-rce",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T14:49:30.555315Z",
"id": "CVE-2026-125883",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T14:49:36.853Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125958.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "N-able",
"dateReserved": "2026-11-10T14:45:24.155Z",
"datePublished": "2026-11-10T21:21:38.490Z",
"dateUpdated": "2026-11-10T21:21:38.490Z"
"dateUpdated": "2026-11-11T14:55:01.210Z"
},
"containers": {
"cna": {
@@ -125,6 +125,48 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able#preupgrade-helper-root-rce",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-11T14:54:57.851737Z",
"id": "CVE-2026-125958",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-11T14:55:01.210Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126325.json
+233
View File
@@ -0,0 +1,233 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126325",
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"state": "PUBLISHED",
"assignerShortName": "PTC",
"dateReserved": "2026-11-10T20:21:06.335Z",
"datePublished": "2026-11-11T15:02:56.037Z",
"dateUpdated": "2026-11-11T15:02:56.037Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC",
"dateUpdated": "2026-11-11T15:02:56.037Z"
},
"title": "Critical Remote Code Execution (RCE) vulnerability reported in Windchill",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "PTC",
"product": "Windchill",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
},
{
"status": "affected",
"version": "13.1.4.0"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "PTC",
"product": "FlexPLM",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.</p>"
}
]
}
],
"references": [
{
"url": "https://www.ptc.com/en/support/article/CS483249",
"name": "Remote Code Execution (RCE) vulnerability (CVE-2026-126325) reported in Windchill PDMLink and FlexPLM",
"tags": [
"vendor-advisory",
"mitigation",
"permissions-required"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "CRITICAL",
"baseScore": 9.2,
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:M/U:Amber"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "CRITICAL",
"baseScore": 9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/13xxx/CVE-2026-13721.json
+154
View File
@@ -0,0 +1,154 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-13721",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-06-29T14:14:13.025Z",
"datePublished": "2026-11-11T15:00:45.888Z",
"dateUpdated": "2026-11-11T15:00:45.888Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "igzs"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-696",
"description": "CWE-696",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:00:45.888Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-13721"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Folder authorization bypass in the Git Sync provisioning files API"
}
}
}
data/2026/14xxx/CVE-2026-14242.json
+154
View File
@@ -0,0 +1,154 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-14242",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-06-30T13:37:41.500Z",
"datePublished": "2026-11-11T15:01:07.110Z",
"dateUpdated": "2026-11-11T15:01:07.110Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.9",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.5",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.3.0",
"status": "affected",
"version": "13.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "igzs2"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:01:07.110Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-14242"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Authorization bypass in the Git Sync provisioning jobs API"
}
}
}
data/2026/44xxx/CVE-2026-44929.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-44929",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-05-08T09:10:19.592Z",
"datePublished": "2026-11-11T14:46:35.718Z",
"dateUpdated": "2026-11-11T14:46:35.718Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T14:46:35.718Z"
},
"title": "SSRF Vulnerability in Apache Batik",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"cweId": "CWE-918",
"type": "CWE"
}
]
}
],
"source": {
"defect": [
"BATIK-1393"
],
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache XML Graphics Batik",
"packageURL": "pkg:maven/org.apache.xmlgraphics/batik-util",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "1.19.0",
"versionType": "maven"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.xmlgraphics:batik-util"
}
],
"descriptions": [
{
"value": "Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik.</p><p>This issue affects Apache XML Graphics Batik: through 1.19.</p><p>Users are recommended to upgrade to version 1.20, which fixes the issue.</p>"
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread.html/d9zfzmjr8frhylopnq4r7ojwcfk9hbjg",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://issues.apache.org/jira/browse/BATIK-1393",
"tags": [
"issue-tracking"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/55xxx/CVE-2026-55950.json
+100 -34
View File
@@ -8,11 +8,60 @@
"assignerShortName": "EEF",
"dateReserved": "2026-06-17T17:55:15.685Z",
"datePublished": "2026-07-02T16:06:24.783Z",
"dateUpdated": "2026-07-24T14:14:42.082Z"
"dateUpdated": "2026-11-11T15:00:34.795Z"
},
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"dtls_packet_demux"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/dtls_packet_demux.erl"
],
"programRoutines": [
{
"name": "dtls_packet_demux:handle_call/3"
},
{
"name": "dtls_packet_demux:handle_info/2"
},
{
"name": "dtls_packet_demux:new_connection/2"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.14",
"status": "unaffected"
},
{
"at": "28.5.0.3",
"status": "unaffected"
},
{
"at": "29.0.3",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "25.3",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
@@ -22,7 +71,7 @@
"dtls_packet_demux"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/dtls_packet_demux.erl"
@@ -44,7 +93,7 @@
{
"changes": [
{
"at": "11.7.3",
"at": "11.2.12.10",
"status": "unaffected"
},
{
@@ -52,7 +101,7 @@
"status": "unaffected"
},
{
"at": "11.2.12.10",
"at": "11.7.3",
"status": "unaffected"
}
],
@@ -92,26 +141,6 @@
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.3",
"status": "unaffected"
},
{
"at": "28.5.0.3",
"status": "unaffected"
},
{
"at": "27.3.4.14",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "25.3",
"versionType": "otp"
},
{
"lessThan": "e44d2bf01c4473ef2ea7f09e3523cf96de6e4a04",
"status": "affected",
@@ -128,7 +157,12 @@
{
"base64": false,
"type": "text/html",
"value": "<p>The application must accept incoming DTLS connections via <tt>ssl:listen/2</tt> with a UDP-based transport. TLS-only deployments are not affected.</p>"
"value": "<p>The application must accept incoming DTLS connections via <code>ssl:listen/2</code> with a UDP-based transport. TLS-only deployments are not affected.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application must accept incoming DTLS connections via `ssl:listen/2` with a UDP-based transport. TLS-only deployments are not affected."
}
],
"value": "The application must accept incoming DTLS connections via ssl:listen/2 with a UDP-based transport. TLS-only deployments are not affected."
@@ -161,7 +195,8 @@
"negate": false,
"operator": "OR"
}
]
],
"operator": "AND"
}
],
"credits": [
@@ -181,6 +216,7 @@
"value": "Dan Gudmundsson"
}
],
"datePublic": "2026-07-02T16:06:24.000Z",
"descriptions": [
{
"lang": "en",
@@ -188,10 +224,15 @@
{
"base64": false,
"type": "text/html",
"value": "<p>Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (<tt>dtls_packet_demux</tt> module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener.</p><p>A DTLS server listener uses a single shared <tt>dtls_packet_demux</tt> <tt>gen_server</tt> process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple <tt>ClientHello</tt> messages in quick succession), a race condition in the demux's internal <tt>gb_trees</tt> key-value store causes a <tt>{key_exists, {old, Client}}</tt> crash, terminating the demux process. Because the demux is shared across all DTLS associations on that listener, its crash immediately kills every active DTLS session, not just the attacker's.</p><p>The attack is pre-authentication: the attacker only needs to send UDP datagrams containing valid <tt>ClientHello</tt> messages from the same source IP and port before the intermediate <tt>DOWN</tt> monitor message is processed by the <tt>gen_server</tt>. No credentials, no completed handshake, and no special configuration are required, and the crash can be repeated indefinitely to create a persistent denial of service for all clients of that listener.</p><p>This vulnerability is associated with program file <tt>lib/ssl/src/dtls_packet_demux.erl</tt>.</p><p>This issue affects OTP from OTP 25.3 before OTP&nbsp;29.0.3, OTP&nbsp;28.5.0.3 and OTP&nbsp;27.3.4.14, corresponding to ssl from 10.9 before 11.7.3, 11.6.0.3 and 11.2.12.10.</p>"
"value": "<p>Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (<code>dtls_packet_demux</code> module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener.</p>\n<p>A DTLS server listener uses a single shared <code>dtls_packet_demux</code> <code>gen_server</code> process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple <code>ClientHello</code> messages in quick succession), a race condition in the demux's internal <code>gb_trees</code> key-value store causes a <code>{key_exists, {old, Client}}</code> crash, terminating the demux process. Because the demux is shared across all DTLS associations on that listener, its crash immediately kills every active DTLS session, not just the attacker's.</p>\n<p>The attack is pre-authentication: the attacker only needs to send UDP datagrams containing valid <code>ClientHello</code> messages from the same source IP and port before the intermediate <code>DOWN</code> monitor message is processed by the <code>gen_server</code>. No credentials, no completed handshake, and no special configuration are required, and the crash can be repeated indefinitely to create a persistent denial of service for all clients of that listener.</p>\n<p>This vulnerability is associated with program file <code>lib/ssl/src/dtls_packet_demux.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;25.3 before OTP&nbsp;27.3.4.14, OTP&nbsp;28.5.0.3, and OTP&nbsp;29.0.3, corresponding to ssl from 10.9 before 11.2.12.10, 11.6.0.3, and 11.7.3.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (`dtls_packet_demux` module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener.\n\nA DTLS server listener uses a single shared `dtls_packet_demux` `gen_server` process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple `ClientHello` messages in quick succession), a race condition in the demux's internal `gb_trees` key-value store causes a `{key_exists, {old, Client}}` crash, terminating the demux process. Because the demux is shared across all DTLS associations on that listener, its crash immediately kills every active DTLS session, not just the attacker's.\n\nThe attack is pre-authentication: the attacker only needs to send UDP datagrams containing valid `ClientHello` messages from the same source IP and port before the intermediate `DOWN` monitor message is processed by the `gen_server`. No credentials, no completed handshake, and no special configuration are required, and the crash can be repeated indefinitely to create a persistent denial of service for all clients of that listener.\n\nThis vulnerability is associated with program file `lib/ssl/src/dtls_packet_demux.erl`.\n\nThis issue affects OTP from OTP 25.3 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssl from 10.9 before 11.2.12.10, 11.6.0.3, and 11.7.3."
}
],
"value": "Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener.\n\nA DTLS server listener uses a single shared dtls_packet_demux gen_server process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple ClientHello messages in quick succession), a race condition in the demux's internal gb_trees key-value store causes a {key_exists, {old, Client}} crash, terminating the demux process. Because the demux is shared across all DTLS associations on that listener, its crash immediately kills every active DTLS session, not just the attacker's.\n\nThe attack is pre-authentication: the attacker only needs to send UDP datagrams containing valid ClientHello messages from the same source IP and port before the intermediate DOWN monitor message is processed by the gen_server. No credentials, no completed handshake, and no special configuration are required, and the crash can be repeated indefinitely to create a persistent denial of service for all clients of that listener.\n\nThis vulnerability is associated with program file lib/ssl/src/dtls_packet_demux.erl.\n\nThis issue affects OTP from OTP 25.3 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 10.9 before 11.7.3, 11.6.0.3 and 11.2.12.10."
"value": "Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener.\n\nA DTLS server listener uses a single shared dtls_packet_demux gen_server process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple ClientHello messages in quick succession), a race condition in the demux's internal gb_trees key-value store causes a {key_exists, {old, Client}} crash, terminating the demux process. Because the demux is shared across all DTLS associations on that listener, its crash immediately kills every active DTLS session, not just the attacker's.\n\nThe attack is pre-authentication: the attacker only needs to send UDP datagrams containing valid ClientHello messages from the same source IP and port before the intermediate DOWN monitor message is processed by the gen_server. No credentials, no completed handshake, and no special configuration are required, and the crash can be repeated indefinitely to create a persistent denial of service for all clients of that listener.\n\nThis vulnerability is associated with program file lib/ssl/src/dtls_packet_demux.erl.\n\nThis issue affects OTP from OTP 25.3 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssl from 10.9 before 11.2.12.10, 11.6.0.3, and 11.7.3."
}
],
"impacts": [
@@ -208,11 +249,27 @@
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
@@ -238,10 +295,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:14:42.082Z"
"dateUpdated": "2026-11-11T15:00:34.795Z"
},
"references": [
{
"name": "DTLS Denial of Service",
"tags": [
"vendor-advisory",
"related"
@@ -249,24 +307,35 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-hwfc-5hf4-gvr3"
},
{
"name": "EEF CNA record for CVE-2026-55950",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55950.html"
},
{
"name": "OSV record EEF-CVE-2026-55950",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55950"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 44dcb4c in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/44dcb4c3d900777493ce2a6129f451aa475811f9"
},
{
"name": "Fix commit e44d2bf in erlang/otp",
"tags": [
"patch"
],
@@ -276,10 +345,7 @@
"source": {
"discovery": "INTERNAL"
},
"title": "DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions",
"x_generator": {
"engine": "cvelib 1.8.0"
}
"title": "DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions"
},
"adp": [
{
data/2026/55xxx/CVE-2026-55952.json
+97 -30
View File
@@ -8,11 +8,54 @@
"assignerShortName": "EEF",
"dateReserved": "2026-06-17T17:55:15.686Z",
"datePublished": "2026-07-02T16:06:08.474Z",
"dateUpdated": "2026-07-24T14:14:09.990Z"
"dateUpdated": "2026-11-11T14:58:32.325Z"
},
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"tls_handshake_1_3"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/tls_handshake_1_3.erl"
],
"programRoutines": [
{
"name": "tls_handshake_1_3:handle_pre_shared_key/3"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.14",
"status": "unaffected"
},
{
"at": "28.5.0.3",
"status": "unaffected"
},
{
"at": "29.0.3",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "22.2",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
@@ -22,7 +65,7 @@
"tls_handshake_1_3"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/tls_handshake_1_3.erl"
@@ -38,7 +81,7 @@
{
"changes": [
{
"at": "11.7.3",
"at": "11.2.12.10",
"status": "unaffected"
},
{
@@ -46,7 +89,7 @@
"status": "unaffected"
},
{
"at": "11.2.12.10",
"at": "11.7.3",
"status": "unaffected"
}
],
@@ -83,25 +126,9 @@
{
"changes": [
{
"at": "29.0.3",
"at": "095f744713c325acdbd18c23e397f04593c06275",
"status": "unaffected"
},
{
"at": "28.5.0.3",
"status": "unaffected"
},
{
"at": "27.3.4.14",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "22.2",
"versionType": "otp"
},
{
"changes": [
{
"at": "e77823e6d980b2ec0b4fe4ea3f2d098ca239e3ce",
"status": "unaffected"
@@ -131,6 +158,11 @@
"base64": false,
"type": "text/html",
"value": "<p>The vulnerability only affects TLS 1.3 servers that have session tickets enabled (either stateful or stateless mode). TLS 1.2 connections and clients are not affected.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The vulnerability only affects TLS 1.3 servers that have session tickets enabled (either stateful or stateless mode). TLS 1.2 connections and clients are not affected."
}
],
"value": "The vulnerability only affects TLS 1.3 servers that have session tickets enabled (either stateful or stateless mode). TLS 1.2 connections and clients are not affected."
@@ -189,6 +221,7 @@
"value": "Jakub Witczak"
}
],
"datePublic": "2026-07-02T16:06:08.000Z",
"descriptions": [
{
"lang": "en",
@@ -196,10 +229,15 @@
{
"base64": false,
"type": "text/html",
"value": "<p>The Erlang/OTP <tt>ssl</tt> application does not validate that the PSK identity list and binder list carried in a TLS 1.3 <tt>ClientHello</tt> pre-shared key extension have equal length before passing them to the session ticket handler. In <tt>tls_handshake_1_3:handle_pre_shared_key/3</tt>, an <tt>OfferedPreSharedKeys</tt> record with a mismatched number of identities and binders is forwarded directly to <tt>tls_server_session_ticket:use/4</tt>, which crashes the session ticket handler process.</p><p>An unauthenticated remote attacker can send a single crafted <tt>ClientHello</tt> to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket handling on that listener. New TLS 1.3 handshakes complete but subsequently crash when the server attempts to issue a session ticket, effectively making TLS 1.3 unusable on the affected listener until the <tt>ssl</tt> application is restarted. TLS 1.2 connections are not affected.</p><p>This issue affects OTP from OTP 22.2 before OTP&nbsp;29.0.3, OTP&nbsp;28.5.0.3 and OTP&nbsp;27.3.4.14, corresponding to ssl from 9.5 before 11.7.3, 11.6.0.3 and 11.2.12.10.</p>"
"value": "<p>The Erlang/OTP <code>ssl</code> application does not validate that the PSK identity list and binder list carried in a TLS 1.3 <code>ClientHello</code> pre-shared key extension have equal length before passing them to the session ticket handler. In <code>tls_handshake_1_3:handle_pre_shared_key/3</code>, an <code>OfferedPreSharedKeys</code> record with a mismatched number of identities and binders is forwarded directly to <code>tls_server_session_ticket:use/4</code>, which crashes the session ticket handler process.</p>\n<p>An unauthenticated remote attacker can send a single crafted <code>ClientHello</code> to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket handling on that listener. New TLS 1.3 handshakes complete but subsequently crash when the server attempts to issue a session ticket, effectively making TLS 1.3 unusable on the affected listener until the <code>ssl</code> application is restarted. TLS 1.2 connections are not affected.</p>\n<p>This issue affects OTP from OTP&nbsp;22.2 before OTP&nbsp;27.3.4.14, OTP&nbsp;28.5.0.3, and OTP&nbsp;29.0.3, corresponding to ssl from 9.5 before 11.2.12.10, 11.6.0.3, and 11.7.3.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The Erlang/OTP `ssl` application does not validate that the PSK identity list and binder list carried in a TLS 1.3 `ClientHello` pre-shared key extension have equal length before passing them to the session ticket handler. In `tls_handshake_1_3:handle_pre_shared_key/3`, an `OfferedPreSharedKeys` record with a mismatched number of identities and binders is forwarded directly to `tls_server_session_ticket:use/4`, which crashes the session ticket handler process.\n\nAn unauthenticated remote attacker can send a single crafted `ClientHello` to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket handling on that listener. New TLS 1.3 handshakes complete but subsequently crash when the server attempts to issue a session ticket, effectively making TLS 1.3 unusable on the affected listener until the `ssl` application is restarted. TLS 1.2 connections are not affected.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssl from 9.5 before 11.2.12.10, 11.6.0.3, and 11.7.3."
}
],
"value": "The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with a mismatched number of identities and binders is forwarded directly to tls_server_session_ticket:use/4, which crashes the session ticket handler process.\n\nAn unauthenticated remote attacker can send a single crafted ClientHello to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket handling on that listener. New TLS 1.3 handshakes complete but subsequently crash when the server attempts to issue a session ticket, effectively making TLS 1.3 unusable on the affected listener until the ssl application is restarted. TLS 1.2 connections are not affected.\n\nThis issue affects OTP from OTP 22.2 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 9.5 before 11.7.3, 11.6.0.3 and 11.2.12.10."
"value": "The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with a mismatched number of identities and binders is forwarded directly to tls_server_session_ticket:use/4, which crashes the session ticket handler process.\n\nAn unauthenticated remote attacker can send a single crafted ClientHello to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket handling on that listener. New TLS 1.3 handshakes complete but subsequently crash when the server attempts to issue a session ticket, effectively making TLS 1.3 unusable on the affected listener until the ssl application is restarted. TLS 1.2 connections are not affected.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.14, OTP 28.5.0.3, and OTP 29.0.3, corresponding to ssl from 9.5 before 11.2.12.10, 11.6.0.3, and 11.7.3."
}
],
"impacts": [
@@ -216,21 +254,27 @@
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
@@ -256,10 +300,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:14:09.990Z"
"dateUpdated": "2026-11-11T14:58:32.325Z"
},
"references": [
{
"name": "Denial-of-Service for TLS-1.3 server Using Session Tickets",
"tags": [
"vendor-advisory",
"related"
@@ -267,36 +312,56 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-8c57-44c9-pc59"
},
{
"name": "EEF CNA record for CVE-2026-55952",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55952.html"
},
{
"name": "OSV record EEF-CVE-2026-55952",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55952"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 339a279 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/339a279f02ce38a7b23010e56000613e19abb21f"
},
{
"name": "Fix commit 095f744 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/095f744713c325acdbd18c23e397f04593c06275"
},
{
"name": "Fix commit e77823e in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/e77823e6d980b2ec0b4fe4ea3f2d098ca239e3ce"
},
{
"name": "Fix commit 2c3e599 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/2c3e599797644310e5d4aa39c7193420e59dadff"
},
{
"name": "Fix commit 9b5437c in erlang/otp",
"tags": [
"patch"
],
@@ -314,15 +379,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>Disable session tickets on TLS 1.3 servers by setting <tt>session_tickets</tt> to <tt>disabled</tt> in the server's <tt>ssl</tt> options.</li><li>Restrict the server to TLS 1.2 by setting <tt>versions</tt> to <tt>['tlsv1.2']</tt> in the server's <tt>ssl</tt> options.</li></ul>"
"value": "<ul>\n<li>Disable session tickets on TLS 1.3 servers by setting <code>session_tickets</code> to <code>disabled</code> in the server's <code>ssl</code> options.</li>\n<li>Restrict the server to TLS 1.2 by setting <code>versions</code> to <code>['tlsv1.2']</code> in the server's <code>ssl</code> options.</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Disable session tickets on TLS 1.3 servers by setting `session_tickets` to `disabled` in the server's `ssl` options.\n* Restrict the server to TLS 1.2 by setting `versions` to `['tlsv1.2']` in the server's `ssl` options."
}
],
"value": "* Disable session tickets on TLS 1.3 servers by setting session_tickets to disabled in the server's ssl options.\n* Restrict the server to TLS 1.2 by setting versions to ['tlsv1.2'] in the server's ssl options."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
]
},
"adp": [
{
data/2026/58xxx/CVE-2026-58227.json
+86 -34
View File
@@ -8,11 +8,60 @@
"assignerShortName": "EEF",
"dateReserved": "2026-06-29T18:54:08.633Z",
"datePublished": "2026-07-27T14:39:44.609Z",
"dateUpdated": "2026-07-28T09:53:23.614Z"
"dateUpdated": "2026-11-11T14:54:31.941Z"
},
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_certificate"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/ssl_certificate.erl"
],
"programRoutines": [
{
"name": "ssl_certificate:handle_incomplete_chain/5"
},
{
"name": "ssl_certificate:build_certificate_chain/5"
},
{
"name": "ssl_certificate:do_certificate_chain/7"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.15",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "29.0.4",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "23.2",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
@@ -22,7 +71,7 @@
"ssl_certificate"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssl_certificate.erl"
@@ -44,7 +93,7 @@
{
"changes": [
{
"at": "11.7.4",
"at": "11.2.12.11",
"status": "unaffected"
},
{
@@ -52,7 +101,7 @@
"status": "unaffected"
},
{
"at": "11.2.12.11",
"at": "11.7.4",
"status": "unaffected"
}
],
@@ -92,26 +141,6 @@
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "23.2",
"versionType": "otp"
},
{
"changes": [
{
@@ -193,6 +222,7 @@
"value": "John Högberg"
}
],
"datePublic": "2026-07-27T14:39:44.000Z",
"descriptions": [
{
"lang": "en",
@@ -200,10 +230,15 @@
{
"base64": false,
"type": "text/html",
"value": "<p>The Erlang/OTP <tt>ssl</tt> application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In <tt>ssl_certificate:handle_incomplete_chain/5</tt>, the received chain is passed to <tt>ssl_certificate:build_certificate_chain/5</tt>, which walks issuer relationships via <tt>ssl_certificate:do_certificate_chain/7</tt> with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.</p><p>An unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS <tt>Certificate</tt> handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.</p><p>This issue affects OTP from OTP 23.2 before OTP&nbsp;29.0.4, OTP&nbsp;28.5.0.4 and OTP&nbsp;27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.</p>"
"value": "<p>The Erlang/OTP <code>ssl</code> application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In <code>ssl_certificate:handle_incomplete_chain/5</code>, the received chain is passed to <code>ssl_certificate:build_certificate_chain/5</code>, which walks issuer relationships via <code>ssl_certificate:do_certificate_chain/7</code> with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.</p>\n<p>An unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS <code>Certificate</code> handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.</p>\n<p>This issue affects OTP from OTP&nbsp;23.2 before OTP&nbsp;27.3.4.15, OTP&nbsp;28.5.0.4, and OTP&nbsp;29.0.4, corresponding to ssl from 10.2 before 11.2.12.11, 11.6.0.4, and 11.7.4.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The Erlang/OTP `ssl` application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In `ssl_certificate:handle_incomplete_chain/5`, the received chain is passed to `ssl_certificate:build_certificate_chain/5`, which walks issuer relationships via `ssl_certificate:do_certificate_chain/7` with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.\n\nAn unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS `Certificate` handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.\n\nThis issue affects OTP from OTP 23.2 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to ssl from 10.2 before 11.2.12.11, 11.6.0.4, and 11.7.4."
}
],
"value": "The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.\n\nAn unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.\n\nThis issue affects OTP from OTP 23.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11."
"value": "The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.\n\nAn unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.\n\nThis issue affects OTP from OTP 23.2 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to ssl from 10.2 before 11.2.12.11, 11.6.0.4, and 11.7.4."
}
],
"impacts": [
@@ -220,21 +255,27 @@
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
@@ -260,10 +301,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-28T09:53:23.614Z"
"dateUpdated": "2026-11-11T14:54:31.941Z"
},
"references": [
{
"name": "TLS Denial-of-Service using Invalid Cert Chains",
"tags": [
"vendor-advisory",
"related"
@@ -271,49 +313,59 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw"
},
{
"name": "EEF CNA record for CVE-2026-58227",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-58227.html"
},
{
"name": "OSV record EEF-CVE-2026-58227",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-58227"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit addc42d in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/addc42df113f8f15fc20e9dff45490b3ce0d3d6b"
},
{
"name": "Fix commit 7db6472 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/0307bff2c72b685c6bd952daaac6bd661c247d62"
"url": "https://github.com/erlang/otp/commit/7db64720177961e04545681480d691c4be81c54d"
},
{
"name": "Fix commit 241d437 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/241d43703989fec4b6bf637beaeb366d92dcc4c2"
},
{
"name": "Fix commit 0307bff in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/7db64720177961e04545681480d691c4be81c54d"
"url": "https://github.com/erlang/otp/commit/0307bff2c72b685c6bd952daaac6bd661c247d62"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain",
"x_generator": {
"engine": "cvelib 1.8.0"
}
"title": "TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain"
},
"adp": [
{
data/2026/59xxx/CVE-2026-59251.json
+79 -32
View File
@@ -8,11 +8,57 @@
"assignerShortName": "EEF",
"dateReserved": "2026-07-04T04:24:03.653Z",
"datePublished": "2026-07-27T15:30:47.097Z",
"dateUpdated": "2026-07-28T09:54:59.169Z"
"dateUpdated": "2026-11-11T14:22:44.647Z"
},
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"pubkey_policy_tree"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/public_key/src/pubkey_policy_tree.erl"
],
"programRoutines": [
{
"name": "pubkey_policy_tree:add_leaves/2"
},
{
"name": "pubkey_policy_tree:add_leaf_siblings/2"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.15",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "29.0.4",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "26.2",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
@@ -22,7 +68,7 @@
"pubkey_policy_tree"
],
"packageName": "public_key",
"packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/pubkey_policy_tree.erl"
@@ -41,7 +87,7 @@
{
"changes": [
{
"at": "1.21.4",
"at": "1.17.1.5",
"status": "unaffected"
},
{
@@ -49,7 +95,7 @@
"status": "unaffected"
},
{
"at": "1.17.1.5",
"at": "1.21.4",
"status": "unaffected"
}
],
@@ -86,26 +132,6 @@
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "26.2",
"versionType": "otp"
},
{
"changes": [
{
@@ -180,10 +206,15 @@
{
"base64": false,
"type": "text/html",
"value": "<p>Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.</p><p>During RFC 5280 policy processing in <tt>public_key:pkix_path_validation/3</tt>, the certificate policy tree maintained by <tt>pubkey_policy_tree</tt> grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because <tt>pubkey_policy_tree:add_leaves/2</tt> and <tt>pubkey_policy_tree:add_leaf_siblings/2</tt> extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).</p><p>This is the same vulnerability class as OpenSSL's <tt>X509_verify_cert</tt> policy tree DoS.</p><p>This vulnerability is associated with program files <tt>lib/public_key/src/pubkey_policy_tree.erl</tt> and program routines <tt>pubkey_policy_tree:add_leaves/2</tt> and <tt>pubkey_policy_tree:add_leaf_siblings/2</tt>.</p><p>This issue affects OTP from OTP 26.2 before OTP&nbsp;29.0.4, OTP&nbsp;28.5.0.4 and OTP&nbsp;27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5.</p>"
"value": "<p>Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.</p>\n<p>During RFC 5280 policy processing in <code>public_key:pkix_path_validation/3</code>, the certificate policy tree maintained by <code>pubkey_policy_tree</code> grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because <code>pubkey_policy_tree:add_leaves/2</code> and <code>pubkey_policy_tree:add_leaf_siblings/2</code> extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).</p>\n<p>This is the same vulnerability class as OpenSSL's <code>X509_verify_cert</code> policy tree DoS.</p>\n<p>This vulnerability is associated with program files <code>lib/public_key/src/pubkey_policy_tree.erl</code> and program routines <code>pubkey_policy_tree:add_leaves/2</code> and <code>pubkey_policy_tree:add_leaf_siblings/2</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;26.2 before OTP&nbsp;27.3.4.15, OTP&nbsp;28.5.0.4, and OTP&nbsp;29.0.4, corresponding to public_key from 1.15 before 1.17.1.5, 1.20.3.4, and 1.21.4.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.\n\nDuring RFC 5280 policy processing in `public_key:pkix_path_validation/3`, the certificate policy tree maintained by `pubkey_policy_tree` grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because `pubkey_policy_tree:add_leaves/2` and `pubkey_policy_tree:add_leaf_siblings/2` extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).\n\nThis is the same vulnerability class as OpenSSL's `X509_verify_cert` policy tree DoS.\n\nThis vulnerability is associated with program files `lib/public_key/src/pubkey_policy_tree.erl` and program routines `pubkey_policy_tree:add_leaves/2` and `pubkey_policy_tree:add_leaf_siblings/2`.\n\nThis issue affects OTP from OTP 26.2 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to public_key from 1.15 before 1.17.1.5, 1.20.3.4, and 1.21.4."
}
],
"value": "Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.\n\nDuring RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).\n\nThis is the same vulnerability class as OpenSSL's X509_verify_cert policy tree DoS.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.\n\nThis issue affects OTP from OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5."
"value": "Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.\n\nDuring RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).\n\nThis is the same vulnerability class as OpenSSL's X509_verify_cert policy tree DoS.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.\n\nThis issue affects OTP from OTP 26.2 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to public_key from 1.15 before 1.17.1.5, 1.20.3.4, and 1.21.4."
}
],
"impacts": [
@@ -200,21 +231,27 @@
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
@@ -240,10 +277,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-28T09:54:59.169Z"
"dateUpdated": "2026-11-11T14:22:44.647Z"
},
"references": [
{
"name": "Denial of Service via Exponential Certificate Policy Tree Growth",
"tags": [
"vendor-advisory",
"related"
@@ -251,30 +289,42 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352"
},
{
"name": "EEF CNA record for CVE-2026-59251",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59251.html"
},
{
"name": "OSV record EEF-CVE-2026-59251",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59251"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 9d1dda7 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/9d1dda7bad5a64b58c10a1554751689e94131a73"
},
{
"name": "Fix commit f8580fc in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/f8580fc117098c08165f46c26fd0750c5cfb2a90"
},
{
"name": "Fix commit f04c6bb in erlang/otp",
"tags": [
"patch"
],
@@ -284,10 +334,7 @@
"source": {
"discovery": "INTERNAL"
},
"title": "Denial of service via exponential certificate policy tree growth in path validation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
"title": "Denial of service via exponential certificate policy tree growth in path validation"
},
"adp": [
{
data/2026/64xxx/CVE-2026-64200.json
+3 -3
View File
@@ -8,16 +8,16 @@
"assignerShortName": "NI",
"dateReserved": "2026-07-19T15:12:06.825Z",
"datePublished": "2026-09-03T22:06:34.287Z",
"dateUpdated": "2026-09-04T18:26:04.654Z"
"dateUpdated": "2026-11-11T14:48:02.483Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-09-03T22:06:34.287Z"
"dateUpdated": "2026-11-11T14:48:02.483Z"
},
"title": "Out Of Bounds Read in during string conversionwhen parsing a .DSB file in DASYLab",
"title": "Out Of Bounds Read during string conversion when parsing a .DSB file in DASYLab",
"problemTypes": [
{
"descriptions": [
data/2026/71xxx/CVE-2026-71395.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-71395",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-08-06T09:27:16.734Z",
"datePublished": "2026-11-11T14:53:54.218Z",
"dateUpdated": "2026-11-11T14:53:54.218Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T14:53:54.218Z"
},
"title": "Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 unsafe deserialization in hyphenation loading",
"lang": "en",
"cweId": "CWE-502",
"type": "CWE"
}
]
}
],
"source": {
"defect": [
"FOP-3332"
],
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache XML Graphics FOP",
"packageURL": "pkg:maven/org.apache.xmlgraphics/fop-core",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "2.11.0",
"versionType": "maven"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.xmlgraphics:fop-core"
}
],
"descriptions": [
{
"value": "unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.</p><p>This issue affects Apache XML Graphics FOP: through 2.11.</p><p>Users are recommended to upgrade to version 2.12, which fixes the issue.</p>"
}
]
}
],
"references": [
{
"url": "https://issues.apache.org/jira/browse/FOP-3332",
"tags": [
"issue-tracking"
]
},
{
"url": "https://lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
data/2026/76xxx/CVE-2026-76877.json
+5 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Wordfence",
"dateReserved": "2026-08-19T22:01:11.520Z",
"datePublished": "2026-11-10T06:47:00.496Z",
"dateUpdated": "2026-11-10T06:47:00.496Z"
"dateUpdated": "2026-11-11T14:52:59.092Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2026-11-10T06:47:00.496Z"
"dateUpdated": "2026-11-11T14:52:59.092Z"
},
"affected": [
{
@@ -45,6 +45,9 @@
},
{
"url": "https://wpml.org/"
},
{
"url": "https://wpml.org/version/wpml-5-0-0/"
}
],
"problemTypes": [
data/2026/82xxx/CVE-2026-82014.json
+182
View File
@@ -0,0 +1,182 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-82014",
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"state": "PUBLISHED",
"assignerShortName": "GRAFANA",
"dateReserved": "2026-08-27T21:21:07.247Z",
"datePublished": "2026-11-11T15:01:26.306Z",
"dateUpdated": "2026-11-11T15:01:26.306Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.5.10",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.10",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.11",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.14",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.5.10",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.10",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.11",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.14",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.12",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arang"
}
],
"datePublic": "2026-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA",
"dateUpdated": "2026-11-11T15:01:26.306Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-82014"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Team preferences RBAC bypass through the set-home-dash endpoint"
}
}
}
data/2026/85xxx/CVE-2026-85632.json
+144
View File
@@ -0,0 +1,144 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-85632",
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"state": "PUBLISHED",
"assignerShortName": "TR-CERT",
"dateReserved": "2026-09-04T11:58:37.906Z",
"datePublished": "2026-11-11T14:24:31.418Z",
"dateUpdated": "2026-11-11T14:24:31.418Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT",
"dateUpdated": "2026-11-11T14:24:31.418Z"
},
"title": "Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce)",
"datePublic": "2026-11-11T14:15:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-354",
"description": "CWE-354 Improper validation of integrity check value",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
},
{
"capecId": "CAPEC-384",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-384 Application API Message Manipulation via Man-in-the-Middle"
}
]
}
],
"affected": [
{
"vendor": "Sipay Electronic Money and Payment Services Inc.",
"product": "WooCommerce Virtual POS Module",
"versions": [
{
"status": "affected",
"version": "26.8.3",
"lessThan": "26.9.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.\n\nThis issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.<p>This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.</p>"
}
]
}
],
"references": [
{
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1520",
"tags": [
"government-resource"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseSeverity": "CRITICAL",
"baseScore": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Yasin SUER",
"type": "finder"
}
],
"source": {
"defect": [
"TR-26-1520"
],
"advisory": "TR-26-1520",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/89xxx/CVE-2026-89326.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-89326",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-09-11T14:36:27.416Z",
"datePublished": "2026-11-11T14:57:44.444Z",
"dateUpdated": "2026-11-11T14:57:44.444Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-11-11T14:57:44.444Z"
},
"title": "Apache XML Graphics Batik: Check url protocol when loading document",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"cweId": "CWE-346",
"type": "CWE"
}
]
}
],
"source": {
"defect": [
"https://issues.apache.org/jira/browse/BATIK-1398"
],
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache XML Graphics Batik",
"packageURL": "pkg:maven/org.apache.xmlgraphics/batik-bridge",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "1.19.0",
"versionType": "maven"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.xmlgraphics:batik-bridge"
}
],
"descriptions": [
{
"value": "Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol</p><p>This issue affects Apache XML Graphics Batik: through 1.19.</p><p>Users are recommended to upgrade to version 1.20, which fixes the issue.</p>"
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread.html/j52wbxhp9wmysor6kdyqjnjz7pqnsthj",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://issues.apache.org/jira/browse/BATIK-1398",
"tags": [
"issue-tracking"
]
}
],
"metrics": [
{
"other": {
"type": "Textual description of severity",
"content": {
"text": "moderate"
}
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
}
}
data/2026/8xxx/CVE-2026-8035.json
+3 -3
View File
@@ -8,14 +8,14 @@
"assignerShortName": "NI",
"dateReserved": "2026-05-06T13:33:43.142Z",
"datePublished": "2026-06-02T17:22:07.870Z",
"dateUpdated": "2026-06-03T14:08:44.920Z"
"dateUpdated": "2026-11-11T14:45:51.637Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-06-02T17:22:07.870Z"
"dateUpdated": "2026-11-11T14:45:51.637Z"
},
"title": "NULL pointer dereference in NI-PAL",
"problemTypes": [
@@ -50,7 +50,7 @@
"status": "affected",
"version": "0",
"lessThanOrEqual": "26.3.0",
"versionType": "semverImproper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by"
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
data/2026/92xxx/CVE-2026-92092.json
+29 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-15T14:34:28.814Z",
"datePublished": "2026-10-29T19:51:44.996Z",
"dateUpdated": "2026-11-11T03:26:54.451Z"
"dateUpdated": "2026-11-11T14:36:25.727Z"
},
"containers": {
"cna": {
@@ -67,6 +67,25 @@
"cpe:/a:redhat:openshift:4.14::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-ansible",
"defaultStatus": "affected",
"versions": [
{
"version": "0:4.15.0-202611041832.p2.g75406db.assembly.stream.el8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.15::el8",
"cpe:/a:redhat:openshift:4.15::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
@@ -160,6 +179,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:95754",
"name": "RHSA-2026:95754",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:96281",
"name": "RHSA-2026:96281",
@@ -219,7 +246,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T03:26:54.451Z"
"dateUpdated": "2026-11-11T14:36:25.727Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/delta.json
+236 -43
View File
@@ -1,67 +1,260 @@
{
"fetchTime": "2026-11-11T14:15:20.040Z",
"numberOfChanges": 10,
"new": [],
"fetchTime": "2026-11-11T15:13:17.902Z",
"numberOfChanges": 42,
"new": [
{
"cveId": "CVE-2026-102589",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102589",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102589.json",
"dateUpdated": "2026-11-11T15:03:07.435Z"
},
{
"cveId": "CVE-2026-110289",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110289",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110289.json",
"dateUpdated": "2026-11-11T15:03:27.711Z"
},
{
"cveId": "CVE-2026-111024",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111024",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111024.json",
"dateUpdated": "2026-11-11T15:02:47.099Z"
},
{
"cveId": "CVE-2026-124746",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124746",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124746.json",
"dateUpdated": "2026-11-11T15:03:07.440Z"
},
{
"cveId": "CVE-2026-126325",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126325",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126325.json",
"dateUpdated": "2026-11-11T15:02:56.037Z"
}
],
"updated": [
{
"cveId": "CVE-2026-103503",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103503",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103503.json",
"dateUpdated": "2026-11-11T14:04:54.738Z"
"cveId": "CVE-2026-121014",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121014",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121014.json",
"dateUpdated": "2026-11-11T15:12:51.144Z"
},
{
"cveId": "CVE-2026-105274",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105274",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105274.json",
"dateUpdated": "2026-11-11T14:05:54.298Z"
"cveId": "CVE-2026-121028",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121028",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121028.json",
"dateUpdated": "2026-11-11T15:12:18.443Z"
},
{
"cveId": "CVE-2026-105280",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105280",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105280.json",
"dateUpdated": "2026-11-11T14:03:00.287Z"
"cveId": "CVE-2026-121574",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121574",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121574.json",
"dateUpdated": "2026-11-11T15:12:34.065Z"
},
{
"cveId": "CVE-2026-114690",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114690",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114690.json",
"dateUpdated": "2026-11-11T14:04:00.142Z"
"cveId": "CVE-2026-121663",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121663",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121663.json",
"dateUpdated": "2026-11-11T15:06:27.495Z"
},
{
"cveId": "CVE-2026-114691",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114691",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114691.json",
"dateUpdated": "2026-11-11T14:04:00.245Z"
"cveId": "CVE-2026-121665",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121665",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121665.json",
"dateUpdated": "2026-11-11T15:07:01.946Z"
},
{
"cveId": "CVE-2026-115455",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115455",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115455.json",
"dateUpdated": "2026-11-11T14:04:00.225Z"
"cveId": "CVE-2026-121668",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121668",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121668.json",
"dateUpdated": "2026-11-11T15:06:44.002Z"
},
{
"cveId": "CVE-2026-115456",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115456",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115456.json",
"dateUpdated": "2026-11-11T14:04:29.305Z"
"cveId": "CVE-2026-121680",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121680",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121680.json",
"dateUpdated": "2026-11-11T15:06:05.247Z"
},
{
"cveId": "CVE-2026-32146",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32146",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32146.json",
"dateUpdated": "2026-11-11T14:13:44.294Z"
"cveId": "CVE-2026-122164",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122164",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122164.json",
"dateUpdated": "2026-11-11T15:05:44.674Z"
},
{
"cveId": "CVE-2026-70399",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-70399",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70399.json",
"dateUpdated": "2026-11-11T14:07:28.956Z"
"cveId": "CVE-2026-122169",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122169",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122169.json",
"dateUpdated": "2026-11-11T15:05:26.222Z"
},
{
"cveId": "CVE-2026-91000",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91000",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91000.json",
"dateUpdated": "2026-11-11T14:02:43.025Z"
"cveId": "CVE-2026-122177",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122177",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122177.json",
"dateUpdated": "2026-11-11T15:05:09.787Z"
},
{
"cveId": "CVE-2026-123481",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123481",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123481.json",
"dateUpdated": "2026-11-11T15:07:40.974Z"
},
{
"cveId": "CVE-2026-124255",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124255",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124255.json",
"dateUpdated": "2026-11-11T15:11:31.322Z"
},
{
"cveId": "CVE-2026-124261",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124261",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124261.json",
"dateUpdated": "2026-11-11T15:09:18.796Z"
},
{
"cveId": "CVE-2026-124262",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124262",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124262.json",
"dateUpdated": "2026-11-11T15:10:59.630Z"
},
{
"cveId": "CVE-2026-124269",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124269",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124269.json",
"dateUpdated": "2026-11-11T15:10:43.528Z"
},
{
"cveId": "CVE-2026-124416",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124416",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124416.json",
"dateUpdated": "2026-11-11T15:08:29.559Z"
},
{
"cveId": "CVE-2026-124417",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124417",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124417.json",
"dateUpdated": "2026-11-11T15:10:27.257Z"
},
{
"cveId": "CVE-2026-124421",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124421",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124421.json",
"dateUpdated": "2026-11-11T15:11:15.851Z"
},
{
"cveId": "CVE-2026-124753",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124753",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124753.json",
"dateUpdated": "2026-11-11T15:11:47.464Z"
},
{
"cveId": "CVE-2026-125046",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125046",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125046.json",
"dateUpdated": "2026-11-11T15:06:16.899Z"
},
{
"cveId": "CVE-2026-125431",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125431",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125431.json",
"dateUpdated": "2026-11-11T15:09:02.494Z"
},
{
"cveId": "CVE-2026-125435",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125435",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125435.json",
"dateUpdated": "2026-11-11T15:10:10.945Z"
},
{
"cveId": "CVE-2026-125436",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125436",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125436.json",
"dateUpdated": "2026-11-11T15:08:12.885Z"
},
{
"cveId": "CVE-2026-125437",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125437",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125437.json",
"dateUpdated": "2026-11-11T15:12:02.981Z"
},
{
"cveId": "CVE-2026-125448",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125448",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125448.json",
"dateUpdated": "2026-11-11T15:07:24.388Z"
},
{
"cveId": "CVE-2026-125746",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125746",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125746.json",
"dateUpdated": "2026-11-11T15:06:32.648Z"
},
{
"cveId": "CVE-2026-125763",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125763",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125763.json",
"dateUpdated": "2026-11-11T15:07:56.635Z"
},
{
"cveId": "CVE-2026-125766",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125766",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125766.json",
"dateUpdated": "2026-11-11T15:07:05.321Z"
},
{
"cveId": "CVE-2026-125767",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125767",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125767.json",
"dateUpdated": "2026-11-11T15:06:48.807Z"
},
{
"cveId": "CVE-2026-125776",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125776",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125776.json",
"dateUpdated": "2026-11-11T15:09:34.839Z"
},
{
"cveId": "CVE-2026-125778",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125778",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125778.json",
"dateUpdated": "2026-11-11T15:08:46.964Z"
},
{
"cveId": "CVE-2026-125782",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125782",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125782.json",
"dateUpdated": "2026-11-11T15:09:51.270Z"
},
{
"cveId": "CVE-2026-125838",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125838",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125838.json",
"dateUpdated": "2026-11-11T15:04:51.234Z"
},
{
"cveId": "CVE-2026-125839",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125839",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125839.json",
"dateUpdated": "2026-11-11T15:05:10.463Z"
},
{
"cveId": "CVE-2026-125840",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125840",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125840.json",
"dateUpdated": "2026-11-11T15:05:26.455Z"
},
{
"cveId": "CVE-2026-125841",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125841",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125841.json",
"dateUpdated": "2026-11-11T15:05:44.439Z"
},
{
"cveId": "CVE-2026-125842",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125842",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125842.json",
"dateUpdated": "2026-11-11T15:06:00.860Z"
}
],
"error": []
data/deltaLog.json
+489 -225
View File
@@ -1,4 +1,493 @@
[
{
"fetchTime": "2026-11-11T15:13:17.902Z",
"numberOfChanges": 42,
"new": [
{
"cveId": "CVE-2026-102589",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102589",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102589.json",
"dateUpdated": "2026-11-11T15:03:07.435Z"
},
{
"cveId": "CVE-2026-110289",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110289",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110289.json",
"dateUpdated": "2026-11-11T15:03:27.711Z"
},
{
"cveId": "CVE-2026-111024",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111024",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111024.json",
"dateUpdated": "2026-11-11T15:02:47.099Z"
},
{
"cveId": "CVE-2026-124746",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124746",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124746.json",
"dateUpdated": "2026-11-11T15:03:07.440Z"
},
{
"cveId": "CVE-2026-126325",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126325",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126325.json",
"dateUpdated": "2026-11-11T15:02:56.037Z"
}
],
"updated": [
{
"cveId": "CVE-2026-121014",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121014",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121014.json",
"dateUpdated": "2026-11-11T15:12:51.144Z"
},
{
"cveId": "CVE-2026-121028",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121028",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121028.json",
"dateUpdated": "2026-11-11T15:12:18.443Z"
},
{
"cveId": "CVE-2026-121574",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121574",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121574.json",
"dateUpdated": "2026-11-11T15:12:34.065Z"
},
{
"cveId": "CVE-2026-121663",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121663",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121663.json",
"dateUpdated": "2026-11-11T15:06:27.495Z"
},
{
"cveId": "CVE-2026-121665",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121665",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121665.json",
"dateUpdated": "2026-11-11T15:07:01.946Z"
},
{
"cveId": "CVE-2026-121668",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121668",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121668.json",
"dateUpdated": "2026-11-11T15:06:44.002Z"
},
{
"cveId": "CVE-2026-121680",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121680",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121680.json",
"dateUpdated": "2026-11-11T15:06:05.247Z"
},
{
"cveId": "CVE-2026-122164",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122164",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122164.json",
"dateUpdated": "2026-11-11T15:05:44.674Z"
},
{
"cveId": "CVE-2026-122169",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122169",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122169.json",
"dateUpdated": "2026-11-11T15:05:26.222Z"
},
{
"cveId": "CVE-2026-122177",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122177",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122177.json",
"dateUpdated": "2026-11-11T15:05:09.787Z"
},
{
"cveId": "CVE-2026-123481",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123481",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123481.json",
"dateUpdated": "2026-11-11T15:07:40.974Z"
},
{
"cveId": "CVE-2026-124255",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124255",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124255.json",
"dateUpdated": "2026-11-11T15:11:31.322Z"
},
{
"cveId": "CVE-2026-124261",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124261",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124261.json",
"dateUpdated": "2026-11-11T15:09:18.796Z"
},
{
"cveId": "CVE-2026-124262",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124262",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124262.json",
"dateUpdated": "2026-11-11T15:10:59.630Z"
},
{
"cveId": "CVE-2026-124269",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124269",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124269.json",
"dateUpdated": "2026-11-11T15:10:43.528Z"
},
{
"cveId": "CVE-2026-124416",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124416",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124416.json",
"dateUpdated": "2026-11-11T15:08:29.559Z"
},
{
"cveId": "CVE-2026-124417",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124417",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124417.json",
"dateUpdated": "2026-11-11T15:10:27.257Z"
},
{
"cveId": "CVE-2026-124421",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124421",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124421.json",
"dateUpdated": "2026-11-11T15:11:15.851Z"
},
{
"cveId": "CVE-2026-124753",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124753",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124753.json",
"dateUpdated": "2026-11-11T15:11:47.464Z"
},
{
"cveId": "CVE-2026-125046",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125046",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125046.json",
"dateUpdated": "2026-11-11T15:06:16.899Z"
},
{
"cveId": "CVE-2026-125431",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125431",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125431.json",
"dateUpdated": "2026-11-11T15:09:02.494Z"
},
{
"cveId": "CVE-2026-125435",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125435",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125435.json",
"dateUpdated": "2026-11-11T15:10:10.945Z"
},
{
"cveId": "CVE-2026-125436",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125436",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125436.json",
"dateUpdated": "2026-11-11T15:08:12.885Z"
},
{
"cveId": "CVE-2026-125437",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125437",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125437.json",
"dateUpdated": "2026-11-11T15:12:02.981Z"
},
{
"cveId": "CVE-2026-125448",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125448",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125448.json",
"dateUpdated": "2026-11-11T15:07:24.388Z"
},
{
"cveId": "CVE-2026-125746",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125746",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125746.json",
"dateUpdated": "2026-11-11T15:06:32.648Z"
},
{
"cveId": "CVE-2026-125763",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125763",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125763.json",
"dateUpdated": "2026-11-11T15:07:56.635Z"
},
{
"cveId": "CVE-2026-125766",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125766",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125766.json",
"dateUpdated": "2026-11-11T15:07:05.321Z"
},
{
"cveId": "CVE-2026-125767",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125767",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125767.json",
"dateUpdated": "2026-11-11T15:06:48.807Z"
},
{
"cveId": "CVE-2026-125776",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125776",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125776.json",
"dateUpdated": "2026-11-11T15:09:34.839Z"
},
{
"cveId": "CVE-2026-125778",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125778",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125778.json",
"dateUpdated": "2026-11-11T15:08:46.964Z"
},
{
"cveId": "CVE-2026-125782",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125782",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125782.json",
"dateUpdated": "2026-11-11T15:09:51.270Z"
},
{
"cveId": "CVE-2026-125838",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125838",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125838.json",
"dateUpdated": "2026-11-11T15:04:51.234Z"
},
{
"cveId": "CVE-2026-125839",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125839",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125839.json",
"dateUpdated": "2026-11-11T15:05:10.463Z"
},
{
"cveId": "CVE-2026-125840",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125840",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125840.json",
"dateUpdated": "2026-11-11T15:05:26.455Z"
},
{
"cveId": "CVE-2026-125841",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125841",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125841.json",
"dateUpdated": "2026-11-11T15:05:44.439Z"
},
{
"cveId": "CVE-2026-125842",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125842",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125842.json",
"dateUpdated": "2026-11-11T15:06:00.860Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T15:02:43.257Z",
"numberOfChanges": 10,
"new": [
{
"cveId": "CVE-2026-107509",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107509",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107509.json",
"dateUpdated": "2026-11-11T15:02:06.763Z"
},
{
"cveId": "CVE-2026-110992",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110992",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110992.json",
"dateUpdated": "2026-11-11T15:01:46.486Z"
},
{
"cveId": "CVE-2026-111000",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111000",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111000.json",
"dateUpdated": "2026-11-11T15:02:26.998Z"
},
{
"cveId": "CVE-2026-123710",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123710",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123710.json",
"dateUpdated": "2026-11-11T15:02:31.341Z"
},
{
"cveId": "CVE-2026-13721",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-13721",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/13xxx/CVE-2026-13721.json",
"dateUpdated": "2026-11-11T15:00:45.888Z"
},
{
"cveId": "CVE-2026-14242",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-14242",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14242.json",
"dateUpdated": "2026-11-11T15:01:07.110Z"
},
{
"cveId": "CVE-2026-82014",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-82014",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82014.json",
"dateUpdated": "2026-11-11T15:01:26.306Z"
},
{
"cveId": "CVE-2026-89326",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-89326",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89326.json",
"dateUpdated": "2026-11-11T14:57:44.444Z"
}
],
"updated": [
{
"cveId": "CVE-2026-55950",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-55950",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55950.json",
"dateUpdated": "2026-11-11T15:00:34.795Z"
},
{
"cveId": "CVE-2026-55952",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-55952",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55952.json",
"dateUpdated": "2026-11-11T14:58:32.325Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T14:56:44.339Z",
"numberOfChanges": 8,
"new": [
{
"cveId": "CVE-2026-106023",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106023",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106023.json",
"dateUpdated": "2026-11-11T14:55:26.491Z"
},
{
"cveId": "CVE-2026-109163",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109163",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109163.json",
"dateUpdated": "2026-11-11T14:55:08.116Z"
},
{
"cveId": "CVE-2026-119618",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-119618",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119618.json",
"dateUpdated": "2026-11-11T14:54:08.155Z"
},
{
"cveId": "CVE-2026-71395",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-71395",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71395.json",
"dateUpdated": "2026-11-11T14:53:54.218Z"
}
],
"updated": [
{
"cveId": "CVE-2025-2630",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-2630",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2630.json",
"dateUpdated": "2026-11-11T14:52:06.888Z"
},
{
"cveId": "CVE-2026-125958",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125958",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125958.json",
"dateUpdated": "2026-11-11T14:55:01.210Z"
},
{
"cveId": "CVE-2026-58227",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58227",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58227.json",
"dateUpdated": "2026-11-11T14:54:31.941Z"
},
{
"cveId": "CVE-2026-76877",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76877",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76877.json",
"dateUpdated": "2026-11-11T14:52:59.092Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T14:50:53.852Z",
"numberOfChanges": 4,
"new": [
{
"cveId": "CVE-2026-44929",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-44929",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/44xxx/CVE-2026-44929.json",
"dateUpdated": "2026-11-11T14:46:35.718Z"
}
],
"updated": [
{
"cveId": "CVE-2026-125883",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125883",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125883.json",
"dateUpdated": "2026-11-11T14:49:36.853Z"
},
{
"cveId": "CVE-2026-64200",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-64200",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64200.json",
"dateUpdated": "2026-11-11T14:48:02.483Z"
},
{
"cveId": "CVE-2026-8035",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-8035",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/8xxx/CVE-2026-8035.json",
"dateUpdated": "2026-11-11T14:45:51.637Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T14:45:16.663Z",
"numberOfChanges": 1,
"new": [],
"updated": [
{
"cveId": "CVE-2023-4570",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2023-4570",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4570.json",
"dateUpdated": "2026-11-11T14:39:48.025Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T14:39:07.497Z",
"numberOfChanges": 1,
"new": [],
"updated": [
{
"cveId": "CVE-2026-92092",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92092",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92092.json",
"dateUpdated": "2026-11-11T14:36:25.727Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T14:27:18.991Z",
"numberOfChanges": 3,
"new": [
{
"cveId": "CVE-2026-85632",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85632",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85632.json",
"dateUpdated": "2026-11-11T14:24:31.418Z"
}
],
"updated": [
{
"cveId": "CVE-2026-58227",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58227",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58227.json",
"dateUpdated": "2026-11-11T14:26:01.115Z"
},
{
"cveId": "CVE-2026-59251",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-59251",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59251.json",
"dateUpdated": "2026-11-11T14:22:44.647Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T14:21:39.465Z",
"numberOfChanges": 1,
"new": [],
"updated": [
{
"cveId": "CVE-2026-123040",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123040",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123040.json",
"dateUpdated": "2026-11-11T14:15:36.255Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T14:15:20.040Z",
"numberOfChanges": 10,
@@ -842007,230 +842496,5 @@
}
],
"error": []
},
{
"fetchTime": "2026-10-12T15:05:33.272Z",
"numberOfChanges": 10,
"new": [
{
"cveId": "CVE-2026-103527",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103527",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103527.json",
"dateUpdated": "2026-10-12T14:54:53.807Z"
},
{
"cveId": "CVE-2026-103528",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103528",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103528.json",
"dateUpdated": "2026-10-12T14:55:14.883Z"
},
{
"cveId": "CVE-2026-103529",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103529",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103529.json",
"dateUpdated": "2026-10-12T14:55:38.419Z"
},
{
"cveId": "CVE-2026-103535",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103535",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103535.json",
"dateUpdated": "2026-10-12T14:55:58.210Z"
},
{
"cveId": "CVE-2026-103537",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103537",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103537.json",
"dateUpdated": "2026-10-12T14:56:21.364Z"
},
{
"cveId": "CVE-2026-108898",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108898",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108898.json",
"dateUpdated": "2026-10-12T15:00:12.588Z"
}
],
"updated": [
{
"cveId": "CVE-2026-103521",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103521",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103521.json",
"dateUpdated": "2026-10-12T15:00:39.229Z"
},
{
"cveId": "CVE-2026-103522",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103522",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103522.json",
"dateUpdated": "2026-10-12T14:59:41.947Z"
},
{
"cveId": "CVE-2026-103526",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103526",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103526.json",
"dateUpdated": "2026-10-12T14:58:40.777Z"
},
{
"cveId": "CVE-2026-109390",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109390",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109390.json",
"dateUpdated": "2026-10-12T15:02:33.284Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T14:54:53.021Z",
"numberOfChanges": 15,
"new": [
{
"cveId": "CVE-2026-103521",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103521",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103521.json",
"dateUpdated": "2026-10-12T14:52:56.850Z"
},
{
"cveId": "CVE-2026-103522",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103522",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103522.json",
"dateUpdated": "2026-10-12T14:53:34.695Z"
},
{
"cveId": "CVE-2026-103523",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103523",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103523.json",
"dateUpdated": "2026-10-12T14:53:54.845Z"
},
{
"cveId": "CVE-2026-103524",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103524",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103524.json",
"dateUpdated": "2026-10-12T14:54:16.912Z"
},
{
"cveId": "CVE-2026-103526",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103526",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103526.json",
"dateUpdated": "2026-10-12T14:54:35.007Z"
},
{
"cveId": "CVE-2026-108094",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108094",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108094.json",
"dateUpdated": "2026-10-12T14:43:09.674Z"
},
{
"cveId": "CVE-2026-108897",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108897",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108897.json",
"dateUpdated": "2026-10-12T14:45:11.045Z"
},
{
"cveId": "CVE-2026-109390",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109390",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109390.json",
"dateUpdated": "2026-10-12T14:40:10.223Z"
}
],
"updated": [
{
"cveId": "CVE-2026-12613",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-12613",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12613.json",
"dateUpdated": "2026-10-12T14:53:51.751Z"
},
{
"cveId": "CVE-2026-15562",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15562",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15562.json",
"dateUpdated": "2026-10-12T14:42:53.633Z"
},
{
"cveId": "CVE-2026-18390",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18390",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18390.json",
"dateUpdated": "2026-10-12T14:54:14.967Z"
},
{
"cveId": "CVE-2026-93579",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93579",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93579.json",
"dateUpdated": "2026-10-12T14:43:10.669Z"
},
{
"cveId": "CVE-2026-93693",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93693",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93693.json",
"dateUpdated": "2026-10-12T14:43:38.793Z"
},
{
"cveId": "CVE-2026-93694",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93694",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93694.json",
"dateUpdated": "2026-10-12T14:43:50.913Z"
},
{
"cveId": "CVE-2026-93695",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93695",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93695.json",
"dateUpdated": "2026-10-12T14:43:27.675Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T14:34:25.443Z",
"numberOfChanges": 8,
"new": [
{
"cveId": "CVE-2026-108895",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108895",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108895.json",
"dateUpdated": "2026-10-12T14:15:10.292Z"
},
{
"cveId": "CVE-2026-108896",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108896",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108896.json",
"dateUpdated": "2026-10-12T14:30:14.340Z"
},
{
"cveId": "CVE-2026-92877",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92877",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92877.json",
"dateUpdated": "2026-10-12T14:19:28.195Z"
}
],
"updated": [
{
"cveId": "CVE-2026-105059",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105059",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105059.json",
"dateUpdated": "2026-10-12T14:27:14.634Z"
},
{
"cveId": "CVE-2026-106445",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106445",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106445.json",
"dateUpdated": "2026-10-12T14:33:33.060Z"
},
{
"cveId": "CVE-2026-81774",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81774",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81774.json",
"dateUpdated": "2026-10-12T14:28:30.021Z"
},
{
"cveId": "CVE-2026-85013",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85013",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85013.json",
"dateUpdated": "2026-10-12T14:16:54.036Z"
},
{
"cveId": "CVE-2026-85234",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-85234",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85234.json",
"dateUpdated": "2026-10-12T14:16:45.886Z"
}
],
"error": []
}
]