VULN/vuln-cve
1
0
Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-11T21:36:01Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-11 22:36:06 +01:00
parent 9598925b15
commit 7028347c4f
55 changed files with 5739 additions and 1516 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/2024/4xxx/CVE-2024-4079.json
+66 -66
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-4079",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,45 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-04-23T15:11:16.465Z",
"datePublished": "2024-07-23T13:19:35.141Z",
"dateUpdated": "2025-08-27T20:42:58.816Z"
"dateUpdated": "2026-11-11T20:50:38.623Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:50:38.623Z"
},
"title": "Out of Bounds Read Due to Missing Bounds Check in LabVIEW",
"problemTypes": [
{
"defaultStatus": "unaffected",
"product": "LabVIEW",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Heinzl working with CISA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.</span><br>"
}
],
"value": "An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
@@ -58,57 +41,74 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "LabVIEW",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.</span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-23T13:19:35.141Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html"
"lang": "en",
"value": "Michael Heinzl working with CISA",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Out of Bounds Read Due to Missing Bounds Check in LabVIEW",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/4xxx/CVE-2024-4080.json
+98 -97
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-4080",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,45 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-04-23T15:11:19.355Z",
"datePublished": "2024-07-23T13:29:55.012Z",
"dateUpdated": "2025-09-29T18:55:07.333Z"
"dateUpdated": "2026-11-11T20:51:48.932Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:51:48.932Z"
},
"title": "Memory Corruption Due to Improper Length Checks in LabVIEW tdcore.dll",
"problemTypes": [
{
"defaultStatus": "unaffected",
"product": "LabVIEW",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Heinzl working with CISA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.</span><br>"
}
],
"value": "A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-14",
@@ -58,89 +41,107 @@
]
}
],
"metrics": [
"affected": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
"vendor": "NI",
"product": "LabVIEW",
"versions": [
{
"lang": "en",
"value": "GENERAL"
"status": "affected",
"version": "0",
"lessThan": "24.3.0",
"versionType": "semver"
}
]
},
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
"lang": "en",
"value": "A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.",
"supportingMedia": [
{
"lang": "en",
"value": "GENERAL"
"type": "text/html",
"base64": false,
"value": "<span>A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.</span><br>"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2025-09-29T18:55:07.333Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.4,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Michael Heinzl working with CISA",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Memory Corruption Due to Improper Length Checks in LabVIEW tdcore.dll",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6121.json
+85 -85
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6121",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,62 +8,26 @@
"assignerShortName": "NI",
"dateReserved": "2024-06-18T11:41:52.912Z",
"datePublished": "2024-07-22T19:46:11.685Z",
"dateUpdated": "2024-08-01T21:33:05.149Z"
"dateUpdated": "2026-11-11T20:33:18.036Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:33:18.036Z"
},
"title": "NI SystemLink Server Ships Out of Date Redis Version",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SystemLink Server",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-1395",
"description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
"type": "CWE"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "23.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service. </span><br>"
}
],
"value": "An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."
}
],
"impacts": [
@@ -77,57 +41,93 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "SystemLink Server",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "24.1.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NI",
"product": "FlexLogger",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "23.2.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service. </span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-1395",
"description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T19:46:11.685Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"
"lang": "en",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "NI SystemLink Server Ships Out of Date Redis Version",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6122.json
+85 -85
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6122",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,62 +8,26 @@
"assignerShortName": "NI",
"dateReserved": "2024-06-18T11:42:00.421Z",
"datePublished": "2024-07-22T19:27:10.034Z",
"dateUpdated": "2024-08-01T21:33:04.403Z"
"dateUpdated": "2026-11-11T20:32:00.063Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:32:00.063Z"
},
"title": "Incorrect Default Directory Permissions for NI SystemLink Redis Service",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SystemLink Server",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"type": "CWE"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "23.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.</span><br>"
}
],
"value": "An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."
}
],
"impacts": [
@@ -77,57 +41,93 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "SystemLink Server",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "24.1.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NI",
"product": "FlexLogger",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "23.2.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.</span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T19:27:10.034Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"
"lang": "en",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect Default Directory Permissions for NI SystemLink Redis Service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6638.json
+66 -66
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6638",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,45 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-07-09T23:58:45.236Z",
"datePublished": "2024-07-22T19:55:23.548Z",
"dateUpdated": "2024-08-01T21:41:04.317Z"
"dateUpdated": "2026-11-11T20:39:21.728Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:39:21.728Z"
},
"title": "Integer Overflow Vulnerability Reading TDMS Files in LabVIEW",
"problemTypes": [
{
"defaultStatus": "unaffected",
"product": "LabVIEW",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "James McNally of Wiresmith Technology"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions.</span><br>"
}
],
"value": "An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
@@ -58,57 +41,74 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "LabVIEW",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "24.1.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions.</span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseSeverity": "MEDIUM",
"baseScore": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T19:55:23.548Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html"
"lang": "en",
"value": "James McNally of Wiresmith Technology",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Integer Overflow Vulnerability Reading TDMS Files in LabVIEW",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6675.json
+69 -69
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6675",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,48 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-07-10T21:15:47.344Z",
"datePublished": "2024-07-22T20:01:15.981Z",
"dateUpdated": "2024-08-01T21:41:04.305Z"
"dateUpdated": "2026-11-11T20:42:54.147Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:42:54.147Z"
},
"title": "Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VeriStand",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.2",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions.</span><br>"
}
],
"value": "A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
@@ -61,57 +41,77 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "VeriStand",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.5.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions.</span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-veristand-project-file.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T20:01:15.981Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-veristand-project-file.html"
"lang": "en",
"value": "kimiya working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6791.json
+69 -69
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6791",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,48 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-07-16T14:19:50.444Z",
"datePublished": "2024-07-22T20:38:14.144Z",
"dateUpdated": "2024-08-01T21:45:38.049Z"
"dateUpdated": "2026-11-11T20:44:34.344Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:44:34.344Z"
},
"title": "Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VeriStand",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.2",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions.</span><br>"
}
],
"value": "A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
@@ -61,57 +41,77 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "VeriStand",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.5.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions.</span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T20:38:14.144Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html"
"lang": "en",
"value": "kimiya working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6793.json
+69 -69
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6793",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,48 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-07-16T15:33:11.806Z",
"datePublished": "2024-07-22T20:47:52.793Z",
"dateUpdated": "2024-08-01T21:45:37.783Z"
"dateUpdated": "2026-11-11T20:45:37.429Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:45:37.429Z"
},
"title": "Deserialization of Untrusted Data in NI VeriStand DataLogging Server",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VeriStand",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.2",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">deserialization of untrusted data&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">vulnerability&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.</span></span></span><br>"
}
],
"value": "A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
@@ -61,57 +41,77 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "VeriStand",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.5.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A&nbsp;<span>deserialization of untrusted data&nbsp;<span>vulnerability&nbsp;<span>exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.</span></span></span><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "CRITICAL",
"baseScore": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T20:47:52.793Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"
"lang": "en",
"value": "kimiya working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Deserialization of Untrusted Data in NI VeriStand DataLogging Server",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6794.json
+69 -69
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6794",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,48 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-07-16T15:33:13.306Z",
"datePublished": "2024-07-22T20:50:40.727Z",
"dateUpdated": "2024-08-01T21:45:37.947Z"
"dateUpdated": "2026-11-11T20:46:50.304Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:46:50.304Z"
},
"title": "Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VeriStand",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.2",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiativ"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.</p><br>"
}
],
"value": "A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
@@ -61,57 +41,77 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "VeriStand",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.5.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.</p><br>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "CRITICAL",
"baseScore": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T20:50:40.727Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"
"lang": "en",
"value": "kimiya working with Trend Micro Zero Day Initiativ",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6805.json
+69 -69
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6805",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,48 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-07-16T19:27:33.451Z",
"datePublished": "2024-07-22T21:00:21.584Z",
"dateUpdated": "2024-08-01T21:45:38.363Z"
"dateUpdated": "2026-11-11T20:48:08.611Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:48:08.611Z"
},
"title": "Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VeriStand",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.2",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in information disclosure or remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.</p>"
}
],
"value": "The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in information disclosure or remote code execution. This affects NI VeriStand 2024 Q2 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
@@ -61,57 +41,77 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "VeriStand",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.5.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in information disclosure or remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in information disclosure or remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.</p>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T21:00:21.584Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"
"lang": "en",
"value": "kimiya working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2024/6xxx/CVE-2024-6806.json
+69 -69
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6806",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,48 +8,28 @@
"assignerShortName": "NI",
"dateReserved": "2024-07-16T19:27:34.873Z",
"datePublished": "2024-07-22T21:03:16.156Z",
"dateUpdated": "2024-08-01T21:45:38.240Z"
"dateUpdated": "2026-11-11T20:49:04.253Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:49:04.253Z"
},
"title": "Missing Authorization Checks In NI VeriStand Gateway For Project Resources",
"problemTypes": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VeriStand",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.2",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"type": "CWE"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.</p>"
}
],
"value": "The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
@@ -61,57 +41,77 @@
]
}
],
"affected": [
{
"vendor": "NI",
"product": "VeriStand",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.5.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.</p>"
}
]
}
],
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "CRITICAL",
"baseScore": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"problemTypes": [
"credits": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2024-07-22T21:03:16.156Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"
"lang": "en",
"value": "kimiya working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authorization Checks In NI VeriStand Gateway For Project Resources",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2026/100xxx/CVE-2026-100307.json
+188
View File
@@ -0,0 +1,188 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-100307",
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"state": "PUBLISHED",
"assignerShortName": "AMZN",
"dateReserved": "2026-09-25T18:55:53.070Z",
"datePublished": "2026-11-11T20:34:49.807Z",
"dateUpdated": "2026-11-11T20:34:49.807Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN",
"dateUpdated": "2026-11-11T20:34:49.807Z"
},
"title": "Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"description": "CWE-862 Missing authorization",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"affected": [
{
"vendor": "AWS",
"product": "mcp-gateway-registry",
"versions": [
{
"status": "affected",
"version": "1.0.9",
"lessThanOrEqual": "1.24.7",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:aws:mcp-gateway-registry:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.0.9",
"versionEndIncluding": "1.24.7"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.25.0.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.</p><p>To remediate this issue, users should upgrade to version 1.25.0.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.25.0",
"tags": [
"release-notes",
"patch"
]
},
{
"url": "https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-rxf3-qgpv-wxvr",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://aws.amazon.com/security/security-bulletins/2026-179-aws/",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
}
}
data/2026/103xxx/CVE-2026-103980.json
+101
View File
@@ -0,0 +1,101 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-103980",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-10-01T16:09:08.456Z",
"datePublished": "2026-11-11T20:58:51.161Z",
"dateUpdated": "2026-11-11T20:58:51.161Z"
},
"containers": {
"cna": {
"title": "ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"lang": "en",
"description": "CWE-918: Server-Side Request Forgery",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q"
},
{
"name": "https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d"
},
{
"name": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6"
}
],
"affected": [
{
"vendor": "3xpyth0n",
"product": "ideon",
"versions": [
{
"version": "< 0.9.6",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-11T20:58:51.161Z"
},
"descriptions": [
{
"lang": "en",
"value": "ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6."
}
],
"source": {
"advisory": "GHSA-fwh7-rv72-xh5q",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/120xxx/CVE-2026-120627.json
+2 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "certcc",
"dateReserved": "2026-11-02T17:31:22.160Z",
"datePublished": "2026-11-02T17:32:34.968Z",
"dateUpdated": "2026-11-10T14:49:00.434Z"
"dateUpdated": "2026-11-11T20:18:59.139Z"
},
"containers": {
"cna": {
@@ -62,7 +62,7 @@
"providerMetadata": {
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc",
"dateUpdated": "2026-11-10T14:49:00.434Z"
"dateUpdated": "2026-11-11T20:18:59.139Z"
}
},
"adp": [
data/2026/122xxx/CVE-2026-122056.json
+5 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-04T16:34:16.396Z",
"datePublished": "2026-11-09T20:33:16.401Z",
"dateUpdated": "2026-11-09T20:33:16.401Z"
"dateUpdated": "2026-11-11T20:59:28.541Z"
},
"containers": {
"cna": {
@@ -124,6 +124,9 @@
"issue-tracking",
"x_refsource_REDHAT"
]
},
{
"url": "https://github.com/OpenSCAP/openscap/security/advisories/GHSA-5h6x-q65w-wxvf"
}
],
"datePublic": "2026-11-09T19:47:01.452Z",
@@ -161,7 +164,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-09T20:33:16.401Z"
"dateUpdated": "2026-11-11T20:59:28.541Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124737.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.478Z",
"datePublished": "2026-11-11T09:40:57.419Z",
"dateUpdated": "2026-11-11T09:40:57.419Z"
"dateUpdated": "2026-11-11T20:27:24.333Z"
},
"containers": {
"cna": {
@@ -121,13 +121,13 @@
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
"value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T09:40:57.419Z"
"dateUpdated": "2026-11-11T20:27:24.333Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124738.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.478Z",
"datePublished": "2026-11-11T11:19:49.225Z",
"dateUpdated": "2026-11-11T11:19:49.225Z"
"dateUpdated": "2026-11-11T20:27:53.311Z"
},
"containers": {
"cna": {
@@ -121,13 +121,13 @@
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
"value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:19:49.225Z"
"dateUpdated": "2026-11-11T20:27:53.311Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124739.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.478Z",
"datePublished": "2026-11-11T10:41:07.813Z",
"dateUpdated": "2026-11-11T10:41:07.813Z"
"dateUpdated": "2026-11-11T20:27:27.305Z"
},
"containers": {
"cna": {
@@ -121,13 +121,13 @@
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
"value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T10:41:07.813Z"
"dateUpdated": "2026-11-11T20:27:27.305Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124743.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.478Z",
"datePublished": "2026-11-11T11:19:56.916Z",
"dateUpdated": "2026-11-11T11:19:56.916Z"
"dateUpdated": "2026-11-11T20:27:57.065Z"
},
"containers": {
"cna": {
@@ -121,13 +121,13 @@
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
"value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:19:56.916Z"
"dateUpdated": "2026-11-11T20:27:57.065Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124745.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.479Z",
"datePublished": "2026-11-11T12:29:18.382Z",
"dateUpdated": "2026-11-11T12:29:18.382Z"
"dateUpdated": "2026-11-11T21:00:04.441Z"
},
"containers": {
"cna": {
@@ -121,13 +121,13 @@
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
"value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T12:29:18.382Z"
"dateUpdated": "2026-11-11T21:00:04.441Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/125xxx/CVE-2026-125926.json
+172
View File
@@ -0,0 +1,172 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-125926",
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"state": "PUBLISHED",
"assignerShortName": "AMZN",
"dateReserved": "2026-11-10T14:18:12.481Z",
"datePublished": "2026-11-11T20:50:28.168Z",
"dateUpdated": "2026-11-11T20:50:28.168Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN",
"dateUpdated": "2026-11-11T20:50:28.168Z"
},
"title": "Server-side request forgery in the server registration and update API in mcp-gateway-registry",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"affected": [
{
"vendor": "AWS",
"product": "mcp-gateway-registry",
"versions": [
{
"status": "affected",
"version": "1.0.3",
"lessThanOrEqual": "1.34.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:aws:mcp-gateway-registry:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.0.3",
"versionEndIncluding": "1.34.0"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.35.0.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.</p><p>To remediate this issue, users should upgrade to version 1.35.0.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0",
"tags": [
"release-notes",
"patch"
]
},
{
"url": "https://aws.amazon.com/security/security-bulletins/2026-180-aws/",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 8.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
}
}
data/2026/126xxx/CVE-2026-126797.json
+140
View File
@@ -0,0 +1,140 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126797",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:46.748Z",
"datePublished": "2026-11-11T20:53:02.665Z",
"dateUpdated": "2026-11-11T20:53:02.665Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:02.665Z"
},
"datePublic": "2026-11-07T02:20:53.000Z",
"title": "NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
"descriptions": [
{
"lang": "en",
"value": "NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Use of Hard-coded Cryptographic Key",
"cweId": "CWE-321",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "tongcheng-security-team",
"product": "NextScan",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.1.0",
"lessThanOrEqual": "1.2.0",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:docker/lysec/ns-admin"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
}
}
],
"references": [
{
"url": "https://github.com/tongcheng-security-team/NextScan/issues/48",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml",
"tags": [
"product"
]
},
{
"url": "https://hub.docker.com/r/lysec/ns-admin",
"tags": [
"product"
]
},
{
"url": "https://vul.yulun.ac.cn/20261107/nextscan/",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-jwt-key-authentication-bypass-in-ns-admin"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126798.json
+134
View File
@@ -0,0 +1,134 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126798",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:47.109Z",
"datePublished": "2026-11-11T20:53:03.298Z",
"dateUpdated": "2026-11-11T20:53:03.298Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:03.298Z"
},
"datePublic": "2026-11-07T02:22:31.000Z",
"title": "NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View",
"descriptions": [
{
"lang": "en",
"value": "NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "tongcheng-security-team",
"product": "NextScan",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.1.0",
"lessThanOrEqual": "1.2.0",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:docker/lysec/ns-admin"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 2.1,
"baseSeverity": "LOW"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/tongcheng-security-team/NextScan/issues/49",
"tags": [
"issue-tracking"
]
},
{
"url": "https://hub.docker.com/r/lysec/ns-admin",
"tags": [
"product"
]
},
{
"url": "https://vul.yulun.ac.cn/20261107/nextscan/",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126799.json
+160
View File
@@ -0,0 +1,160 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126799",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:47.477Z",
"datePublished": "2026-11-11T20:53:03.948Z",
"dateUpdated": "2026-11-11T20:53:03.948Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:03.948Z"
},
"datePublic": "2026-11-11T07:18:07.000Z",
"title": "Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP",
"descriptions": [
{
"lang": "en",
"value": "Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Server-Side Request Forgery (SSRF)",
"cweId": "CWE-918",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "gotenberg",
"product": "gotenberg",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.31.0",
"lessThan": "8.38.0",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:golang/github.com/gotenberg/gotenberg/v8"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.31.0",
"versionEndExcluding": "8.38.0"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fqg9-x2xw-5crx",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-fqg9-x2xw-5crx)"
},
{
"url": "https://github.com/gotenberg/gotenberg/commit/8e850b1c932452627fba397f2005dd6fd57b9617",
"tags": [
"patch"
]
},
{
"url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0",
"tags": [
"release-notes"
],
"name": "gotenberg v8.38.0 Release Notes"
},
{
"url": "https://github.com/gotenberg/gotenberg/blob/v8.37.0/pkg/gotenberg/outbound.go#L112-L142",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gotenberg-8.31.0-before-8.38.0-ssrf-via-ipv6-zone-identifiers-in-ispublicip"
}
],
"credits": [
{
"lang": "en",
"value": "euriconicacio",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126800.json
+134
View File
@@ -0,0 +1,134 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126800",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:47.836Z",
"datePublished": "2026-11-11T20:53:04.583Z",
"dateUpdated": "2026-11-11T20:53:04.583Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:04.583Z"
},
"datePublic": "2026-11-07T04:13:42.000Z",
"title": "Hydro @hydrooj/ui-default before 4.59.1 Stored XSS via Markdown language- Class",
"descriptions": [
{
"lang": "en",
"value": "Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "hydro-dev",
"product": "@hydrooj/ui-default",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "4.59.1",
"status": "affected",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40hydrooj/ui-default"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/hydro-dev/Hydro/commit/3bae56fe8edddff12346bcb1c8281269c94688d8",
"tags": [
"patch"
]
},
{
"url": "https://github.com/hydro-dev/Hydro/blob/3c8286dd1350fcd00412e95d5b056dbfed64edda/packages/ui-default/backendlib/markdown-it-xss.ts#L150-L157",
"tags": [
"technical-description"
]
},
{
"url": "https://vul.yulun.ac.cn/20261107/hydro/",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: Hydro @hydrooj/ui-default before 4.59.1 Stored XSS via Markdown language- Class",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hydro-hydrooj-ui-default-before-4.59.1-stored-xss-via-markdown-language-class"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126801.json
+141
View File
@@ -0,0 +1,141 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126801",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:48.192Z",
"datePublished": "2026-11-11T20:53:05.337Z",
"dateUpdated": "2026-11-11T20:53:05.337Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:05.337Z"
},
"datePublic": "2026-10-31T05:06:43.000Z",
"title": "Rote 1.2.0 through 2.6.0 Account Takeover via OAuth Account Merge Endpoint",
"descriptions": [
{
"lang": "en",
"value": "Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Rabithua",
"product": "Rote",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.2.0",
"lessThanOrEqual": "2.6.0",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/rabithua/rote"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/Rabithua/Rote/pull/420",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b",
"tags": [
"patch"
]
},
{
"url": "https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659",
"tags": [
"technical-description"
]
},
{
"url": "https://vul.yulun.ac.cn/20261104/rote/",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: Rote 1.2.0 through 2.6.0 Account Takeover via OAuth Account Merge Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126802.json
+134
View File
@@ -0,0 +1,134 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126802",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:48.610Z",
"datePublished": "2026-11-11T20:53:06.025Z",
"dateUpdated": "2026-11-11T20:53:06.025Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:06.025Z"
},
"datePublic": "2026-11-07T02:23:53.000Z",
"title": "NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs",
"descriptions": [
{
"lang": "en",
"value": "NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Use of Hard-coded Credentials",
"cweId": "CWE-798",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "tongcheng-security-team",
"product": "NextScan",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.1.0",
"lessThanOrEqual": "1.2.0",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:docker/lysec/ns-admin"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/tongcheng-security-team/NextScan/issues/50",
"tags": [
"issue-tracking"
]
},
{
"url": "https://hub.docker.com/r/lysec/ns-admin",
"tags": [
"product"
]
},
{
"url": "https://vul.yulun.ac.cn/20261107/nextscan/",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126803.json
+141
View File
@@ -0,0 +1,141 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126803",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:49.010Z",
"datePublished": "2026-11-11T20:53:06.708Z",
"dateUpdated": "2026-11-11T20:53:06.708Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:06.708Z"
},
"datePublic": "2026-10-31T05:06:43.000Z",
"title": "Rote through 2.6.0 Privilege Escalation via Admin Settings API JWT Secret Exposure",
"descriptions": [
{
"lang": "en",
"value": "Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Privilege Management",
"cweId": "CWE-269",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Rabithua",
"product": "Rote",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "2.6.0",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/rabithua/rote"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/Rabithua/Rote/pull/420",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b",
"tags": [
"patch"
]
},
{
"url": "https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/admin.ts#L86-L146",
"tags": [
"technical-description"
]
},
{
"url": "https://vul.yulun.ac.cn/20261104/rote/",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: Rote through 2.6.0 Privilege Escalation via Admin Settings API JWT Secret Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rote-through-2.6.0-privilege-escalation-via-admin-settings-api-jwt-secret-exposure"
}
],
"credits": [
{
"lang": "en",
"value": "Wu Yulun",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126804.json
+159
View File
@@ -0,0 +1,159 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126804",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:49.366Z",
"datePublished": "2026-11-11T20:53:07.372Z",
"dateUpdated": "2026-11-11T20:53:07.372Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:07.372Z"
},
"datePublic": "2026-11-11T14:02:41.000Z",
"title": "WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.php",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "WWBN",
"product": "AVideo",
"defaultStatus": "unaffected",
"versions": [
{
"version": "12.4",
"lessThanOrEqual": "29.7.1",
"versionType": "custom",
"status": "affected"
}
],
"packageURL": "pkg:github/WWBN/AVideo"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.4",
"versionEndIncluding": "29.7.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-58h3-9722-fgpm",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-58h3-9722-fgpm)"
},
{
"url": "https://github.com/WWBN/AVideo/commit/c2b99663d6442e2182a0f3ab95ea6731a193b301",
"tags": [
"patch"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/deleteImage.json.php#L53-L63",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/ADs.php#L194-L219",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.7.1-path-traversal-file-deletion-via-deleteimage-json-php"
}
],
"credits": [
{
"lang": "en",
"value": "AlpetGexha",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126805.json
+158
View File
@@ -0,0 +1,158 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126805",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:49.705Z",
"datePublished": "2026-11-11T20:53:08.078Z",
"dateUpdated": "2026-11-11T20:53:08.078Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:08.078Z"
},
"datePublic": "2026-11-11T14:36:13.000Z",
"title": "WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "WWBN",
"product": "AVideo",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "29.7.1",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/WWBN/AVideo"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "29.7.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8wjr-gw73-9f2g",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-8wjr-gw73-9f2g)"
},
{
"url": "https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07",
"tags": [
"patch"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/objects/EncoderJobStatus.php#L31-L42",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functions.php#L7619-L7647",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-privilege-escalation-via-encoder-video-id-hash"
}
],
"credits": [
{
"lang": "en",
"value": "AlpetGexha",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126806.json
+159
View File
@@ -0,0 +1,159 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126806",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:50.048Z",
"datePublished": "2026-11-11T20:53:08.751Z",
"dateUpdated": "2026-11-11T20:53:08.751Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:08.751Z"
},
"datePublic": "2026-11-11T14:21:03.000Z",
"title": "WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "WWBN",
"product": "AVideo",
"defaultStatus": "unaffected",
"versions": [
{
"version": "14.3",
"lessThanOrEqual": "29.7.1",
"versionType": "custom",
"status": "affected"
}
],
"packageURL": "pkg:github/WWBN/AVideo"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.3",
"versionEndIncluding": "29.7.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-2qq6-qfcq-jmr9)"
},
{
"url": "https://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f",
"tags": [
"patch"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functionTags.php#L198-L221",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/view/managerVideos_body.php#L1997-L2011",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag"
}
],
"credits": [
{
"lang": "en",
"value": "AlpetGexha",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126807.json
+146
View File
@@ -0,0 +1,146 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126807",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:50.410Z",
"datePublished": "2026-11-11T20:53:09.618Z",
"dateUpdated": "2026-11-11T20:53:09.618Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:09.618Z"
},
"datePublic": "2026-11-11T15:12:21.000Z",
"title": "WuzAPI through 1.1.0 Cross-Tenant Information Disclosure via /chat/history",
"descriptions": [
{
"lang": "en",
"value": "WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chat_jid=index to list every user's internal ID, stored chat JIDs, and last-message times."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Authorization Bypass Through User-Controlled Key",
"cweId": "CWE-639",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "asternic",
"product": "wuzapi",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.1.0",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:golang/github.com/asternic/wuzapi"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/asternic/wuzapi/issues/407",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/asternic/wuzapi/commit/f5332fa21b7c8a742f9ee565328ea776ad0c8040",
"tags": [
"patch"
]
},
{
"url": "https://github.com/asternic/wuzapi/blob/v1.1.0/handlers.go#L7269-L7296",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/asternic/wuzapi/blob/v1.1.0/routes.go#L139",
"tags": [
"technical-description"
]
},
{
"url": "https://hackmd.io/@hieund/wuzapi-chat-history-index-cross-tenant-idor",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: WuzAPI through 1.1.0 Cross-Tenant Information Disclosure via /chat/history",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wuzapi-through-1.1.0-cross-tenant-information-disclosure-via-chat-history"
}
],
"credits": [
{
"lang": "en",
"value": "hieuPenguinnn",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126808.json
+164
View File
@@ -0,0 +1,164 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126808",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:50.746Z",
"datePublished": "2026-11-11T20:53:10.317Z",
"dateUpdated": "2026-11-11T20:53:10.317Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:10.317Z"
},
"datePublic": "2026-11-07T04:06:09.000Z",
"title": "WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers",
"descriptions": [
{
"lang": "en",
"value": "weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "weDevs",
"product": "ERP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.17.11",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/wp-erp/wp-erp"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:jerryhanjj:erp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.11"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/wp-erp/wp-erp/issues/1691",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/wp-erp/wp-erp/pull/1693",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0",
"tags": [
"patch"
]
},
{
"url": "https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers"
}
],
"credits": [
{
"lang": "en",
"value": "George Chen",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126809.json
+158
View File
@@ -0,0 +1,158 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126809",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:51.103Z",
"datePublished": "2026-11-11T20:53:10.991Z",
"dateUpdated": "2026-11-11T20:53:10.991Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:10.991Z"
},
"datePublic": "2026-11-11T16:24:21.000Z",
"title": "WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Missing Authorization",
"cweId": "CWE-862",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "WWBN",
"product": "AVideo",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThanOrEqual": "29.7.1",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/WWBN/AVideo"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "29.7.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH"
}
}
],
"references": [
{
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g69x-xc9q-2g2v",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-g69x-xc9q-2g2v)"
},
{
"url": "https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0",
"tags": [
"patch"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/objects/import.json.php#L16-L81",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/objects/listFiles.json.php#L15-L35",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-objects-import-json-php"
}
],
"credits": [
{
"lang": "en",
"value": "AlpetGexha",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126810.json
+159
View File
@@ -0,0 +1,159 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126810",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:51.454Z",
"datePublished": "2026-11-11T20:53:11.690Z",
"dateUpdated": "2026-11-11T20:53:11.690Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:11.690Z"
},
"datePublic": "2026-11-11T16:10:59.000Z",
"title": "WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "WWBN",
"product": "AVideo",
"defaultStatus": "unaffected",
"versions": [
{
"version": "29.1.0",
"lessThanOrEqual": "29.7.1",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/WWBN/AVideo"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionStartIncluding": "29.1.0",
"versionEndIncluding": "29.7.1"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-2qxw-wm6h-5jr7)"
},
{
"url": "https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f",
"tags": [
"patch"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/feed/index.php#L143-L169",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/WWBN/AVideo/blob/v29.7.1/feed/rss-style.xsl#L32-L41",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed"
}
],
"credits": [
{
"lang": "en",
"value": "AlpetGexha",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126811.json
+188
View File
@@ -0,0 +1,188 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126811",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:51.844Z",
"datePublished": "2026-11-11T20:53:12.349Z",
"dateUpdated": "2026-11-11T20:53:12.349Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:12.349Z"
},
"datePublic": "2026-11-11T11:43:37.000Z",
"title": "BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints",
"descriptions": [
{
"lang": "en",
"value": "BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "BookStackApp",
"product": "BookStack",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "26.09.3",
"versionType": "custom",
"status": "affected"
}
],
"packageURL": "pkg:github/BookStackApp/BookStack"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.09.3"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://codeberg.org/bookstack/bookstack/commit/926e16a23f346be47d44746d14cba40cb355cbe1",
"tags": [
"patch"
]
},
{
"url": "https://codeberg.org/bookstack/bookstack/commit/4fec06236cbfb314fd72c1b3614c7c50162fb41c",
"tags": [
"patch"
]
},
{
"url": "https://github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40cb355cbe1",
"tags": [
"patch"
]
},
{
"url": "https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/",
"tags": [
"release-notes"
]
},
{
"url": "https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3",
"tags": [
"release-notes"
]
},
{
"url": "https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3",
"tags": [
"release-notes"
],
"name": "BookStack v26.09.3 Release Notes"
},
{
"url": "https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/DrawioImageController.php#L82-L92",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/ImageController.php#L159-L169",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/fishtankyu/bookstack-draft-image-idor-advisory.md",
"tags": [
"third-party-advisory"
]
},
{
"name": "VulnCheck Advisory: BookStack before 26.09.3 Incorrect Authorization via Image and Drawio Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-via-image-and-drawio-endpoints"
}
],
"credits": [
{
"lang": "en",
"value": "Zeng Yu",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126812.json
+155
View File
@@ -0,0 +1,155 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126812",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:52.201Z",
"datePublished": "2026-11-11T20:53:12.974Z",
"dateUpdated": "2026-11-11T20:53:12.974Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:12.974Z"
},
"datePublic": "2026-11-11T16:04:26.000Z",
"title": "blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose",
"descriptions": [
{
"lang": "en",
"value": "blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Empty Password in Configuration File",
"cweId": "CWE-258",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "blueprintue",
"product": "blueprintue-self-hosted-edition",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0.0",
"lessThan": "4.3.7",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
}
}
],
"references": [
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-9f6r-vjc7-jq67",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-9f6r-vjc7-jq67)"
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/e6a6e1d4c2f22efbbabf9fb31ec479544405b469",
"tags": [
"patch"
]
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/270",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.7",
"tags": [
"release-notes"
],
"name": "blueprintue-self-hosted-edition v4.3.7 Release Notes"
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/database.env",
"tags": [
"technical-description"
]
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/docker-compose-smtp.yml#L14-L24",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.7-empty-mariadb-root-password-via-docker-compose"
}
],
"credits": [
{
"lang": "en",
"value": "Farhan Khan",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126813.json
+189
View File
@@ -0,0 +1,189 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126813",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:52.550Z",
"datePublished": "2026-11-11T20:53:13.638Z",
"dateUpdated": "2026-11-11T20:53:13.638Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:13.638Z"
},
"datePublic": "2026-11-09T12:01:09.000Z",
"title": "Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid",
"descriptions": [
{
"lang": "en",
"value": "Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')",
"cweId": "CWE-93",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Roundcube",
"product": "Webmail",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "1.6.21",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.7.0",
"lessThan": "1.7.6",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:composer/roundcube/roundcubemail"
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.7.0",
"versionEndExcluding": "1.7.6"
}
]
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb",
"tags": [
"patch"
]
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c",
"tags": [
"patch"
]
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80",
"tags": [
"patch"
]
},
{
"url": "https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892",
"tags": [
"technical-description"
]
},
{
"url": "https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.21",
"tags": [
"release-notes"
],
"name": "Webmail 1.6.21 Release Notes"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.6",
"tags": [
"release-notes"
],
"name": "Webmail 1.7.6 Release Notes"
},
{
"name": "VulnCheck Advisory: Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"
}
],
"credits": [
{
"lang": "en",
"value": "Dexx-tech",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/126xxx/CVE-2026-126814.json
+149
View File
@@ -0,0 +1,149 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126814",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T20:01:52.901Z",
"datePublished": "2026-11-11T20:53:14.311Z",
"dateUpdated": "2026-11-11T20:53:14.311Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-11T20:53:14.311Z"
},
"datePublic": "2026-11-11T16:34:07.000Z",
"title": "blueprintUE Self-Hosted Edition before 4.3.6 Arbitrary Iframe Embedding via PeerTube Matcher",
"descriptions": [
{
"lang": "en",
"value": "blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Inclusion of Functionality from Untrusted Control Sphere",
"cweId": "CWE-829",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "blueprintue",
"product": "blueprintue-self-hosted-edition",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.0.0",
"lessThan": "4.3.6",
"versionType": "semver",
"status": "affected"
}
],
"packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM"
}
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW"
}
}
],
"references": [
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-3vgc-fcfg-v233",
"tags": [
"vendor-advisory"
],
"name": "GitHub Security Advisory (GHSA-3vgc-fcfg-v233)"
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/5f13e2bb8cd4c620899e9f8afd41a6e62b3bc6a4",
"tags": [
"patch"
]
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/269",
"tags": [
"issue-tracking",
"patch"
]
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.6",
"tags": [
"release-notes"
],
"name": "blueprintue-self-hosted-edition v4.3.6 Release Notes"
},
{
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.5/app/services/www/BlueprintService.php#L700-L716",
"tags": [
"technical-description"
]
},
{
"name": "VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.6 Arbitrary Iframe Embedding via PeerTube Matcher",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.6-arbitrary-iframe-embedding-via-peertube-matcher"
}
],
"credits": [
{
"lang": "en",
"value": "Farhan Khan",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck-endgame"
}
}
}
}
data/2026/65xxx/CVE-2026-65949.json
+146
View File
@@ -0,0 +1,146 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65949",
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"state": "PUBLISHED",
"assignerShortName": "lenovo",
"dateReserved": "2026-07-23T18:09:15.916Z",
"datePublished": "2026-11-11T21:11:31.703Z",
"dateUpdated": "2026-11-11T21:11:31.703Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo",
"dateUpdated": "2026-11-11T21:11:31.703Z"
},
"title": "Lenovo XClarity Integrator for WAC: Gateway-Administrator Remote Command Execution",
"datePublic": "2026-09-08T13:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Lenovo",
"product": "XClarity Integrator for WAC",
"platforms": [
"Windows"
],
"versions": [
{
"status": "affected",
"version": "5.1.1",
"lessThanOrEqual": "5.2.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows Admin Center 5.1.1 and 5.2.0 allows an authenticated remote attacker to execute arbitrary PowerShell commands by submitting a crafted hostname.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<div>Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows Admin Center 5.1.1 and 5.2.0 allows an authenticated remote attacker to execute arbitrary PowerShell commands&nbsp;by submitting a crafted hostname.&nbsp;&nbsp;</div>"
}
]
}
],
"references": [
{
"url": "https://support.lenovo.com/us/en/solutions/ht507549-lenovo-xclarity-integrator-for-microsoft-windows-admin-center-v21"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.6,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
}
}
data/2026/65xxx/CVE-2026-65950.json
+136
View File
@@ -0,0 +1,136 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65950",
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"state": "PUBLISHED",
"assignerShortName": "lenovo",
"dateReserved": "2026-07-23T18:09:15.916Z",
"datePublished": "2026-11-11T21:12:13.454Z",
"dateUpdated": "2026-11-11T21:12:13.454Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo",
"dateUpdated": "2026-11-11T21:12:13.454Z"
},
"title": "Path Traversal (Zip Slip) in Lenovo XClarity OneCLI 5.5.0 Linux",
"datePublic": "2026-09-08T13:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-22",
"description": "CWE-22 Path Traversal",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Lenovo",
"product": "OneCLI",
"platforms": [
"Linux"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "5.6.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted ZIP-based update package.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<div>A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted ZIP-based update package.&nbsp;&nbsp;</div>"
}
]
}
],
"references": [
{
"url": "https://support.lenovo.com/us/en/solutions/ht116433"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "MEDIUM",
"baseScore": 5.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.2,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
}
}
data/2026/65xxx/CVE-2026-65951.json
+134
View File
@@ -0,0 +1,134 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65951",
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"state": "PUBLISHED",
"assignerShortName": "lenovo",
"dateReserved": "2026-07-23T18:09:15.917Z",
"datePublished": "2026-11-11T21:12:32.138Z",
"dateUpdated": "2026-11-11T21:12:32.138Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo",
"dateUpdated": "2026-11-11T21:12:32.138Z"
},
"title": "Path Traversal (Tar Slip) in Lenovo XClarity OneCLI 5.5.0 Linux",
"datePublic": "2026-09-08T13:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE 22 Path Traversal"
}
]
}
],
"affected": [
{
"vendor": "Lenovo",
"product": "OneCLI",
"platforms": [
"Linux"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "5.6.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the TAR.GZ extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted TAR.GZ update package.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A path traversal vulnerability in the TAR.GZ extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted TAR.GZ update package."
}
]
}
],
"references": [
{
"url": "https://support.lenovo.com/us/en/solutions/ht116433"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "MEDIUM",
"baseScore": 5.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.2,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
}
}
data/2026/65xxx/CVE-2026-65952.json
+136
View File
@@ -0,0 +1,136 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65952",
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"state": "PUBLISHED",
"assignerShortName": "lenovo",
"dateReserved": "2026-07-23T18:09:15.917Z",
"datePublished": "2026-11-11T21:12:45.844Z",
"dateUpdated": "2026-11-11T21:12:45.844Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo",
"dateUpdated": "2026-11-11T21:12:45.844Z"
},
"title": "OS Command Injection in Lenovo XClarity OneCLI 5.5.0 Linux",
"datePublic": "2026-09-08T13:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Lenovo",
"product": "OneCLI",
"platforms": [
"Linux"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "5.6.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path."
}
]
}
],
"references": [
{
"url": "https://support.lenovo.com/us/en/solutions/ht116433"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.8,
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
}
}
data/2026/65xxx/CVE-2026-65957.json
+118
View File
@@ -0,0 +1,118 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65957",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-07-23T18:15:14.579Z",
"datePublished": "2026-11-11T20:36:21.626Z",
"dateUpdated": "2026-11-11T20:36:21.626Z"
},
"containers": {
"cna": {
"title": "Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"lang": "en",
"description": "CWE-346: Origin Validation Error",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-942",
"lang": "en",
"description": "CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/gethelio/helio/security/advisories/GHSA-2c3r-q7gv-hp2m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gethelio/helio/security/advisories/GHSA-2c3r-q7gv-hp2m"
},
{
"name": "https://github.com/gethelio/helio/pull/121",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gethelio/helio/pull/121"
},
{
"name": "https://github.com/gethelio/helio/commit/4ca8329c38b0edbc5e4d782a4e3b0cfc5cd7782e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gethelio/helio/commit/4ca8329c38b0edbc5e4d782a4e3b0cfc5cd7782e"
},
{
"name": "https://github.com/gethelio/helio/releases/tag/v0.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gethelio/helio/releases/tag/v0.8.0"
}
],
"affected": [
{
"vendor": "gethelio",
"product": "helio",
"versions": [
{
"version": "< 0.8.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-11T20:36:21.626Z"
},
"descriptions": [
{
"lang": "en",
"value": "Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0."
}
],
"source": {
"advisory": "GHSA-2c3r-q7gv-hp2m",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/65xxx/CVE-2026-65965.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65965",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-07-23T18:15:14.579Z",
"datePublished": "2026-11-11T20:57:24.941Z",
"dateUpdated": "2026-11-11T20:57:24.941Z"
},
"containers": {
"cna": {
"title": "ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/files via role-unchecked project endpoints",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"lang": "en",
"description": "CWE-285: Improper Authorization",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"lang": "en",
"description": "CWE-862: Missing Authorization",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-v3qr-4v8m-29rh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-v3qr-4v8m-29rh"
},
{
"name": "https://github.com/3xpyth0n/ideon/commit/ed58ca7a70543c7fc4ebfef59a2ca34e480e44d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/3xpyth0n/ideon/commit/ed58ca7a70543c7fc4ebfef59a2ca34e480e44d1"
},
{
"name": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4"
}
],
"affected": [
{
"vendor": "3xpyth0n",
"product": "ideon",
"versions": [
{
"version": "< 0.9.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-11T20:57:24.941Z"
},
"descriptions": [
{
"lang": "en",
"value": "ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. The most severe is POST /api/projects/[id]/graph, which deletes every block and link in the project and re-inserts client-supplied ones. A viewer can silently rewrite or wipe the entire canvas of a project they were invited to read. The application clearly intends viewer to be read-only: the collaborators endpoint, the automation endpoints, and the realtime Yjs sync path all reject write attempts from viewers. These specific HTTP handlers simply omit the guard their siblings enforce. This issue has been patched in version 0.9.4."
}
],
"source": {
"advisory": "GHSA-v3qr-4v8m-29rh",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/65xxx/CVE-2026-65968.json
+101
View File
@@ -0,0 +1,101 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65968",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-07-23T18:15:14.580Z",
"datePublished": "2026-11-11T20:57:39.798Z",
"dateUpdated": "2026-11-11T20:57:39.798Z"
},
"containers": {
"cna": {
"title": "ideon: Unauthenticated SSRF in /api/proxy/image via WHATWG bracketed/hex-mapped IPv6 bypass of isSafeUrl guard",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"lang": "en",
"description": "CWE-918: Server-Side Request Forgery",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-cvcr-fcf6-366r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-cvcr-fcf6-366r"
},
{
"name": "https://github.com/3xpyth0n/ideon/commit/58e2f26bb7259d24c963a753962ac34f56c63b01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/3xpyth0n/ideon/commit/58e2f26bb7259d24c963a753962ac34f56c63b01"
},
{
"name": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4"
}
],
"affected": [
{
"vendor": "3xpyth0n",
"product": "ideon",
"versions": [
{
"version": "< 0.9.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-11T20:57:39.798Z"
},
"descriptions": [
{
"lang": "en",
"value": "ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new URL(url).hostname. Their IPv6 branch only recognises the textual forms ::1, fe80:/fc00:/fd00: prefixes, and the dotted-decimal IPv4-mapped form ::ffff:127.x. It does not recognise the WHATWG-canonical IPv4-mapped-IPv6 host that Node emits for a mapped address, which is hex-compressed and bracket-wrapped: [::ffff:7f00:1] for 127.0.0.1, [::ffff:a9fe:a9fe] for 169.254.169.254. An authenticated user who registers a STREAMABLE_HTTP / SSE MCP server with URL http://[::ffff:7f00:1]:PORT/ (loopback) or http://[::ffff:a9fe:a9fe]/ (cloud metadata) passes both guards, and the server-side OAuth-discovery action then fetches that host, yielding server-side request forgery to loopback and to the cloud metadata service. This issue has been patched in version 0.9.4."
}
],
"source": {
"advisory": "GHSA-cvcr-fcf6-366r",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/65xxx/CVE-2026-65973.json
+91
View File
@@ -0,0 +1,91 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65973",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-07-23T18:15:14.580Z",
"datePublished": "2026-11-11T21:02:37.019Z",
"dateUpdated": "2026-11-11T21:02:37.019Z"
},
"containers": {
"cna": {
"title": "Laradocs: Command injection via unescaped Node.js binary path in KaTeX SSR",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"lang": "en",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/PeteBishwhip/laradocs/security/advisories/GHSA-h746-qpxh-ph7g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/PeteBishwhip/laradocs/security/advisories/GHSA-h746-qpxh-ph7g"
},
{
"name": "https://github.com/PeteBishwhip/laradocs/releases/tag/v1.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/PeteBishwhip/laradocs/releases/tag/v1.0.0"
}
],
"affected": [
{
"vendor": "PeteBishwhip",
"product": "laradocs",
"versions": [
{
"version": ">= 0.4.0, < 1.0.0",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-11T21:02:37.019Z"
},
"descriptions": [
{
"lang": "en",
"value": "Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() command string. This issue has been patched in version 1.0.0."
}
],
"source": {
"advisory": "GHSA-h746-qpxh-ph7g",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/65xxx/CVE-2026-65982.json
+94
View File
@@ -0,0 +1,94 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-65982",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-07-23T18:54:15.832Z",
"datePublished": "2026-11-11T21:06:33.886Z",
"dateUpdated": "2026-11-11T21:06:33.886Z"
},
"containers": {
"cna": {
"title": "NULL-pointer dereference (DoS) in nginx-http-flv-module",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"lang": "en",
"description": "CWE-476: NULL Pointer Dereference",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/winshining/nginx-http-flv-module/security/advisories/GHSA-8mc6-jrxv-29g9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/winshining/nginx-http-flv-module/security/advisories/GHSA-8mc6-jrxv-29g9"
},
{
"name": "https://www.chtsecurity.com/news/b15d7b24-0a5e-4962-8b52-e4754e5af4f8?lang=en",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/b15d7b24-0a5e-4962-8b52-e4754e5af4f8?lang=en"
}
],
"affected": [
{
"vendor": "winshining",
"product": "nginx-http-flv-module",
"versions": [
{
"version": "< 1.2.14",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-11T21:06:33.886Z"
},
"descriptions": [
{
"lang": "en",
"value": "nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14."
}
],
"source": {
"advisory": "GHSA-8mc6-jrxv-29g9",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/68xxx/CVE-2026-68507.json
+104
View File
@@ -0,0 +1,104 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-68507",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-07-30T16:19:08.081Z",
"datePublished": "2026-11-11T20:57:49.243Z",
"dateUpdated": "2026-11-11T20:57:49.243Z"
},
"containers": {
"cna": {
"title": "ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"lang": "en",
"description": "CWE-306: Missing Authentication for Critical Functionality",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"lang": "en",
"description": "CWE-918: Server-Side Request Forgery",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p"
},
{
"name": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/3xpyth0n/ideon/releases/tag/v0.9.5"
}
],
"affected": [
{
"vendor": "3xpyth0n",
"product": "ideon",
"versions": [
{
"version": "< 0.9.5",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-11T20:57:49.243Z"
},
"descriptions": [
{
"lang": "en",
"value": "ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 \"any address\" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5."
}
],
"source": {
"advisory": "GHSA-vpc2-r395-534p",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/81xxx/CVE-2026-81936.json
+136
View File
@@ -0,0 +1,136 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-81936",
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"state": "PUBLISHED",
"assignerShortName": "lenovo",
"dateReserved": "2026-08-27T19:23:16.511Z",
"datePublished": "2026-11-11T21:13:17.524Z",
"dateUpdated": "2026-11-11T21:13:17.524Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo",
"dateUpdated": "2026-11-11T21:13:17.524Z"
},
"title": "Default OpenBMC Root Credential Reintroduced After Reset to Defaults in ThinkSystem v4 XCC3",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-1392",
"description": "CWE-1392: Use of Default Credentials",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Lenovo",
"product": "XClarity Controller",
"platforms": [
"64 bit",
"ARM"
],
"versions": [
{
"status": "affected",
"version": "IHX432Y",
"lessThanOrEqual": "IHX436K",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation.  An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation.&nbsp; An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression."
}
]
}
],
"references": [
{
"url": "https://lenovopress.lenovo.com/lp2273-lenovo-xclarity-controller-3-xcc3"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "MEDIUM",
"baseScore": 6.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
}
}
data/2026/88xxx/CVE-2026-88829.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-10T09:42:04.558Z",
"datePublished": "2026-10-14T10:00:42.946Z",
"dateUpdated": "2026-10-15T15:09:08.090Z"
"dateUpdated": "2026-11-11T20:27:47.355Z"
},
"containers": {
"cna": {
@@ -82,14 +82,14 @@
"descriptions": [
{
"cweId": "CWE-444",
"description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
"description": "Inconsistent Interpretation of HTTP Requests",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
"x_redhatCweChain": "CWE-444: Inconsistent Interpretation of HTTP Requests",
"workarounds": [
{
"lang": "en",
@@ -117,7 +117,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-10-14T10:00:42.946Z"
"dateUpdated": "2026-11-11T20:27:47.355Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/90xxx/CVE-2026-90954.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T11:58:18.067Z",
"datePublished": "2026-10-14T10:00:08.215Z",
"dateUpdated": "2026-10-19T19:04:36.467Z"
"dateUpdated": "2026-11-11T20:15:25.307Z"
},
"containers": {
"cna": {
@@ -82,14 +82,14 @@
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access ('Link Following')",
"description": "Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access ('Link Following')",
"x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access",
"workarounds": [
{
"lang": "en",
@@ -117,7 +117,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-10-14T10:00:08.215Z"
"dateUpdated": "2026-11-11T20:15:25.307Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/delta.json
+27 -40
View File
@@ -1,51 +1,38 @@
{
"fetchTime": "2026-11-11T20:13:56.941Z",
"numberOfChanges": 7,
"fetchTime": "2026-11-11T21:18:55.665Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2026-0323",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0323",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0323.json",
"dateUpdated": "2026-11-11T20:03:37.104Z"
"cveId": "CVE-2026-65949",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65949",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65949.json",
"dateUpdated": "2026-11-11T21:11:31.703Z"
},
{
"cveId": "CVE-2026-0324",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0324",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0324.json",
"dateUpdated": "2026-11-11T20:02:33.834Z"
"cveId": "CVE-2026-65950",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65950",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65950.json",
"dateUpdated": "2026-11-11T21:12:13.454Z"
},
{
"cveId": "CVE-2026-126815",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126815",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126815.json",
"dateUpdated": "2026-11-11T20:10:36.118Z"
}
],
"updated": [
{
"cveId": "CVE-2024-12740",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-12740",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12740.json",
"dateUpdated": "2026-11-11T20:12:55.497Z"
},
{
"cveId": "CVE-2025-4748",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-4748",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/4xxx/CVE-2025-4748.json",
"dateUpdated": "2026-11-11T20:04:45.959Z"
},
{
"cveId": "CVE-2026-120730",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120730",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120730.json",
"dateUpdated": "2026-11-11T20:09:55.746Z"
},
{
"cveId": "CVE-2026-120999",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120999",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120999.json",
"dateUpdated": "2026-11-11T20:10:46.282Z"
"cveId": "CVE-2026-65951",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65951",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65951.json",
"dateUpdated": "2026-11-11T21:12:32.138Z"
},
{
"cveId": "CVE-2026-65952",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65952",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65952.json",
"dateUpdated": "2026-11-11T21:12:45.844Z"
},
{
"cveId": "CVE-2026-81936",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81936",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81936.json",
"dateUpdated": "2026-11-11T21:13:17.524Z"
}
],
"updated": [],
"error": []
}
data/deltaLog.json
+329 -633
View File
@@ -1,4 +1,333 @@
[
{
"fetchTime": "2026-11-11T21:18:55.665Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2026-65949",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65949",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65949.json",
"dateUpdated": "2026-11-11T21:11:31.703Z"
},
{
"cveId": "CVE-2026-65950",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65950",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65950.json",
"dateUpdated": "2026-11-11T21:12:13.454Z"
},
{
"cveId": "CVE-2026-65951",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65951",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65951.json",
"dateUpdated": "2026-11-11T21:12:32.138Z"
},
{
"cveId": "CVE-2026-65952",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65952",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65952.json",
"dateUpdated": "2026-11-11T21:12:45.844Z"
},
{
"cveId": "CVE-2026-81936",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81936",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81936.json",
"dateUpdated": "2026-11-11T21:13:17.524Z"
}
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-11-11T21:09:35.255Z",
"numberOfChanges": 47,
"new": [
{
"cveId": "CVE-2026-100307",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100307",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100307.json",
"dateUpdated": "2026-11-11T20:34:49.807Z"
},
{
"cveId": "CVE-2026-103980",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103980",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103980.json",
"dateUpdated": "2026-11-11T20:58:51.161Z"
},
{
"cveId": "CVE-2026-125926",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125926",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125926.json",
"dateUpdated": "2026-11-11T20:50:28.168Z"
},
{
"cveId": "CVE-2026-126797",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126797",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126797.json",
"dateUpdated": "2026-11-11T20:53:02.665Z"
},
{
"cveId": "CVE-2026-126798",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126798",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126798.json",
"dateUpdated": "2026-11-11T20:53:03.298Z"
},
{
"cveId": "CVE-2026-126799",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126799",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126799.json",
"dateUpdated": "2026-11-11T20:53:03.948Z"
},
{
"cveId": "CVE-2026-126800",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126800",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126800.json",
"dateUpdated": "2026-11-11T20:53:04.583Z"
},
{
"cveId": "CVE-2026-126801",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126801",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126801.json",
"dateUpdated": "2026-11-11T20:53:05.337Z"
},
{
"cveId": "CVE-2026-126802",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126802",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126802.json",
"dateUpdated": "2026-11-11T20:53:06.025Z"
},
{
"cveId": "CVE-2026-126803",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126803",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126803.json",
"dateUpdated": "2026-11-11T20:53:06.708Z"
},
{
"cveId": "CVE-2026-126804",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126804",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126804.json",
"dateUpdated": "2026-11-11T20:53:07.372Z"
},
{
"cveId": "CVE-2026-126805",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126805",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126805.json",
"dateUpdated": "2026-11-11T20:53:08.078Z"
},
{
"cveId": "CVE-2026-126806",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126806",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126806.json",
"dateUpdated": "2026-11-11T20:53:08.751Z"
},
{
"cveId": "CVE-2026-126807",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126807",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126807.json",
"dateUpdated": "2026-11-11T20:53:09.618Z"
},
{
"cveId": "CVE-2026-126808",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126808",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126808.json",
"dateUpdated": "2026-11-11T20:53:10.317Z"
},
{
"cveId": "CVE-2026-126809",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126809",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126809.json",
"dateUpdated": "2026-11-11T20:53:10.991Z"
},
{
"cveId": "CVE-2026-126810",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126810",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126810.json",
"dateUpdated": "2026-11-11T20:53:11.690Z"
},
{
"cveId": "CVE-2026-126811",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126811",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126811.json",
"dateUpdated": "2026-11-11T20:53:12.349Z"
},
{
"cveId": "CVE-2026-126812",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126812",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126812.json",
"dateUpdated": "2026-11-11T20:53:12.974Z"
},
{
"cveId": "CVE-2026-126813",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126813",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126813.json",
"dateUpdated": "2026-11-11T20:53:13.638Z"
},
{
"cveId": "CVE-2026-126814",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126814",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126814.json",
"dateUpdated": "2026-11-11T20:53:14.311Z"
},
{
"cveId": "CVE-2026-65957",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65957",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65957.json",
"dateUpdated": "2026-11-11T20:36:21.626Z"
},
{
"cveId": "CVE-2026-65965",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65965",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65965.json",
"dateUpdated": "2026-11-11T20:57:24.941Z"
},
{
"cveId": "CVE-2026-65968",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65968",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65968.json",
"dateUpdated": "2026-11-11T20:57:39.798Z"
},
{
"cveId": "CVE-2026-65973",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65973",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65973.json",
"dateUpdated": "2026-11-11T21:02:37.019Z"
},
{
"cveId": "CVE-2026-65982",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-65982",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65982.json",
"dateUpdated": "2026-11-11T21:06:33.886Z"
},
{
"cveId": "CVE-2026-68507",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-68507",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68507.json",
"dateUpdated": "2026-11-11T20:57:49.243Z"
}
],
"updated": [
{
"cveId": "CVE-2024-4079",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-4079",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4079.json",
"dateUpdated": "2026-11-11T20:50:38.623Z"
},
{
"cveId": "CVE-2024-4080",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-4080",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4080.json",
"dateUpdated": "2026-11-11T20:51:48.932Z"
},
{
"cveId": "CVE-2024-6121",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6121",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6121.json",
"dateUpdated": "2026-11-11T20:33:18.036Z"
},
{
"cveId": "CVE-2024-6122",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6122",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6122.json",
"dateUpdated": "2026-11-11T20:32:00.063Z"
},
{
"cveId": "CVE-2024-6638",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6638",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6638.json",
"dateUpdated": "2026-11-11T20:39:21.728Z"
},
{
"cveId": "CVE-2024-6675",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6675",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6675.json",
"dateUpdated": "2026-11-11T20:42:54.147Z"
},
{
"cveId": "CVE-2024-6791",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6791",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6791.json",
"dateUpdated": "2026-11-11T20:44:34.344Z"
},
{
"cveId": "CVE-2024-6793",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6793",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6793.json",
"dateUpdated": "2026-11-11T20:45:37.429Z"
},
{
"cveId": "CVE-2024-6794",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6794",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6794.json",
"dateUpdated": "2026-11-11T20:46:50.304Z"
},
{
"cveId": "CVE-2024-6805",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6805",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6805.json",
"dateUpdated": "2026-11-11T20:48:08.611Z"
},
{
"cveId": "CVE-2024-6806",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-6806",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/6xxx/CVE-2024-6806.json",
"dateUpdated": "2026-11-11T20:49:04.253Z"
},
{
"cveId": "CVE-2026-120627",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120627",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120627.json",
"dateUpdated": "2026-11-11T20:18:59.139Z"
},
{
"cveId": "CVE-2026-122056",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122056",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122056.json",
"dateUpdated": "2026-11-11T20:59:28.541Z"
},
{
"cveId": "CVE-2026-124737",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124737",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124737.json",
"dateUpdated": "2026-11-11T20:27:24.333Z"
},
{
"cveId": "CVE-2026-124738",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124738",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124738.json",
"dateUpdated": "2026-11-11T20:27:53.311Z"
},
{
"cveId": "CVE-2026-124739",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124739",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124739.json",
"dateUpdated": "2026-11-11T20:27:27.305Z"
},
{
"cveId": "CVE-2026-124743",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124743",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124743.json",
"dateUpdated": "2026-11-11T20:27:57.065Z"
},
{
"cveId": "CVE-2026-124745",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124745",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124745.json",
"dateUpdated": "2026-11-11T21:00:04.441Z"
},
{
"cveId": "CVE-2026-88829",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-88829",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88829.json",
"dateUpdated": "2026-11-11T20:27:47.355Z"
},
{
"cveId": "CVE-2026-90954",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-90954",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90954.json",
"dateUpdated": "2026-11-11T20:15:25.307Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T20:13:56.941Z",
"numberOfChanges": 7,
@@ -848134,638 +848463,5 @@
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-10-12T21:14:32.340Z",
"numberOfChanges": 24,
"new": [
{
"cveId": "CVE-2026-105052",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105052",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105052.json",
"dateUpdated": "2026-10-12T21:05:04.599Z"
},
{
"cveId": "CVE-2026-108931",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108931",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108931.json",
"dateUpdated": "2026-10-12T21:00:15.658Z"
},
{
"cveId": "CVE-2026-18513",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18513",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18513.json",
"dateUpdated": "2026-10-12T21:02:49.427Z"
},
{
"cveId": "CVE-2026-18517",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18517",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18517.json",
"dateUpdated": "2026-10-12T21:03:07.117Z"
},
{
"cveId": "CVE-2026-18529",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18529",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18529.json",
"dateUpdated": "2026-10-12T21:03:29.257Z"
},
{
"cveId": "CVE-2026-18533",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18533",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18533.json",
"dateUpdated": "2026-10-12T21:03:49.419Z"
},
{
"cveId": "CVE-2026-18537",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18537",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18537.json",
"dateUpdated": "2026-10-12T21:04:08.979Z"
},
{
"cveId": "CVE-2026-58462",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58462",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58462.json",
"dateUpdated": "2026-10-12T21:13:31.575Z"
},
{
"cveId": "CVE-2026-75881",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-75881",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75881.json",
"dateUpdated": "2026-10-12T21:04:27.485Z"
},
{
"cveId": "CVE-2026-78673",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-78673",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78673.json",
"dateUpdated": "2026-10-12T21:04:46.890Z"
},
{
"cveId": "CVE-2026-84316",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84316",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84316.json",
"dateUpdated": "2026-10-12T21:06:56.040Z"
},
{
"cveId": "CVE-2026-84317",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84317",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84317.json",
"dateUpdated": "2026-10-12T20:59:58.019Z"
},
{
"cveId": "CVE-2026-84319",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84319",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84319.json",
"dateUpdated": "2026-10-12T21:03:36.112Z"
},
{
"cveId": "CVE-2026-84360",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84360",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84360.json",
"dateUpdated": "2026-10-12T21:08:04.687Z"
}
],
"updated": [
{
"cveId": "CVE-2025-6170",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-6170",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6170.json",
"dateUpdated": "2026-10-12T21:13:39.699Z"
},
{
"cveId": "CVE-2026-107655",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-107655",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107655.json",
"dateUpdated": "2026-10-12T21:00:04.406Z"
},
{
"cveId": "CVE-2026-108119",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108119",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108119.json",
"dateUpdated": "2026-10-12T20:59:23.895Z"
},
{
"cveId": "CVE-2026-18255",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18255",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18255.json",
"dateUpdated": "2026-10-12T21:10:04.837Z"
},
{
"cveId": "CVE-2026-54099",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54099",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54099.json",
"dateUpdated": "2026-10-12T21:09:53.126Z"
},
{
"cveId": "CVE-2026-54100",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-54100",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/54xxx/CVE-2026-54100.json",
"dateUpdated": "2026-10-12T21:09:59.288Z"
},
{
"cveId": "CVE-2026-92116",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92116",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92116.json",
"dateUpdated": "2026-10-12T21:06:21.627Z"
},
{
"cveId": "CVE-2026-92119",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92119",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92119.json",
"dateUpdated": "2026-10-12T21:06:22.900Z"
},
{
"cveId": "CVE-2026-92120",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92120",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92120.json",
"dateUpdated": "2026-10-12T21:06:24.221Z"
},
{
"cveId": "CVE-2026-97062",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97062",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97062.json",
"dateUpdated": "2026-10-12T21:14:17.471Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T20:59:20.056Z",
"numberOfChanges": 47,
"new": [
{
"cveId": "CVE-2020-37279",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-37279",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/37xxx/CVE-2020-37279.json",
"dateUpdated": "2026-10-12T20:55:03.883Z"
},
{
"cveId": "CVE-2020-37280",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2020-37280",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/37xxx/CVE-2020-37280.json",
"dateUpdated": "2026-10-12T20:55:04.662Z"
},
{
"cveId": "CVE-2021-48011",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-48011",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/48xxx/CVE-2021-48011.json",
"dateUpdated": "2026-10-12T20:55:05.305Z"
},
{
"cveId": "CVE-2021-48012",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-48012",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/48xxx/CVE-2021-48012.json",
"dateUpdated": "2026-10-12T20:55:05.966Z"
},
{
"cveId": "CVE-2022-51020",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2022-51020",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/51xxx/CVE-2022-51020.json",
"dateUpdated": "2026-10-12T20:55:06.611Z"
},
{
"cveId": "CVE-2024-58389",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-58389",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/58xxx/CVE-2024-58389.json",
"dateUpdated": "2026-10-12T20:55:07.301Z"
},
{
"cveId": "CVE-2025-71429",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-71429",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71429.json",
"dateUpdated": "2026-10-12T20:55:07.939Z"
},
{
"cveId": "CVE-2026-109375",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109375",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109375.json",
"dateUpdated": "2026-10-12T20:55:08.596Z"
},
{
"cveId": "CVE-2026-109376",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109376",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109376.json",
"dateUpdated": "2026-10-12T20:55:09.200Z"
},
{
"cveId": "CVE-2026-109377",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109377",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109377.json",
"dateUpdated": "2026-10-12T20:55:09.844Z"
},
{
"cveId": "CVE-2026-109378",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109378",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109378.json",
"dateUpdated": "2026-10-12T20:55:10.466Z"
},
{
"cveId": "CVE-2026-109379",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109379",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109379.json",
"dateUpdated": "2026-10-12T20:55:11.101Z"
},
{
"cveId": "CVE-2026-109380",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109380",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109380.json",
"dateUpdated": "2026-10-12T20:55:11.774Z"
},
{
"cveId": "CVE-2026-109556",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109556",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109556.json",
"dateUpdated": "2026-10-12T20:55:12.388Z"
},
{
"cveId": "CVE-2026-109557",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109557",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109557.json",
"dateUpdated": "2026-10-12T20:55:13.067Z"
},
{
"cveId": "CVE-2026-109558",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109558",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109558.json",
"dateUpdated": "2026-10-12T20:55:13.683Z"
},
{
"cveId": "CVE-2026-109559",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109559",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109559.json",
"dateUpdated": "2026-10-12T20:55:14.269Z"
},
{
"cveId": "CVE-2026-109560",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109560",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109560.json",
"dateUpdated": "2026-10-12T20:55:14.911Z"
},
{
"cveId": "CVE-2026-109561",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109561",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109561.json",
"dateUpdated": "2026-10-12T20:55:15.574Z"
},
{
"cveId": "CVE-2026-109562",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109562",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109562.json",
"dateUpdated": "2026-10-12T20:55:16.236Z"
},
{
"cveId": "CVE-2026-109563",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109563",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109563.json",
"dateUpdated": "2026-10-12T20:55:16.880Z"
},
{
"cveId": "CVE-2026-109564",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109564",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109564.json",
"dateUpdated": "2026-10-12T20:55:17.509Z"
},
{
"cveId": "CVE-2026-109565",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109565",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109565.json",
"dateUpdated": "2026-10-12T20:55:18.173Z"
},
{
"cveId": "CVE-2026-109566",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109566",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109566.json",
"dateUpdated": "2026-10-12T20:55:19.825Z"
},
{
"cveId": "CVE-2026-109567",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109567",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109567.json",
"dateUpdated": "2026-10-12T20:55:20.456Z"
},
{
"cveId": "CVE-2026-109568",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109568",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109568.json",
"dateUpdated": "2026-10-12T20:55:21.102Z"
},
{
"cveId": "CVE-2026-109569",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109569",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109569.json",
"dateUpdated": "2026-10-12T20:55:21.738Z"
},
{
"cveId": "CVE-2026-109570",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109570",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109570.json",
"dateUpdated": "2026-10-12T20:55:22.392Z"
},
{
"cveId": "CVE-2026-109571",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109571",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109571.json",
"dateUpdated": "2026-10-12T20:55:23.061Z"
},
{
"cveId": "CVE-2026-16678",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-16678",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16678.json",
"dateUpdated": "2026-10-12T20:52:45.137Z"
},
{
"cveId": "CVE-2026-84313",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84313",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84313.json",
"dateUpdated": "2026-10-12T20:51:44.751Z"
},
{
"cveId": "CVE-2026-96261",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96261",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96261.json",
"dateUpdated": "2026-10-12T20:52:36.496Z"
},
{
"cveId": "CVE-2026-96262",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96262",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96262.json",
"dateUpdated": "2026-10-12T20:52:28.751Z"
},
{
"cveId": "CVE-2026-96263",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96263",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96263.json",
"dateUpdated": "2026-10-12T20:52:20.625Z"
},
{
"cveId": "CVE-2026-96264",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96264",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96264.json",
"dateUpdated": "2026-10-12T20:52:10.876Z"
},
{
"cveId": "CVE-2026-96265",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96265",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96265.json",
"dateUpdated": "2026-10-12T20:52:00.904Z"
},
{
"cveId": "CVE-2026-96266",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96266",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96266.json",
"dateUpdated": "2026-10-12T20:51:56.396Z"
}
],
"updated": [
{
"cveId": "CVE-2026-13757",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-13757",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/13xxx/CVE-2026-13757.json",
"dateUpdated": "2026-10-12T20:53:39.303Z"
},
{
"cveId": "CVE-2026-15588",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15588",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15588.json",
"dateUpdated": "2026-10-12T20:58:18.631Z"
},
{
"cveId": "CVE-2026-16118",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16118.json",
"dateUpdated": "2026-10-12T20:56:49.863Z"
},
{
"cveId": "CVE-2026-18382",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18382",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18382.json",
"dateUpdated": "2026-10-12T20:53:46.248Z"
},
{
"cveId": "CVE-2026-58010",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58010",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58010.json",
"dateUpdated": "2026-10-12T20:58:22.345Z"
},
{
"cveId": "CVE-2026-58011",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58011",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58011.json",
"dateUpdated": "2026-10-12T20:58:25.318Z"
},
{
"cveId": "CVE-2026-58012",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58012",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58012.json",
"dateUpdated": "2026-10-12T20:58:30.858Z"
},
{
"cveId": "CVE-2026-58013",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58013",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58013.json",
"dateUpdated": "2026-10-12T20:58:37.006Z"
},
{
"cveId": "CVE-2026-58014",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58014",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58014.json",
"dateUpdated": "2026-10-12T20:58:41.678Z"
},
{
"cveId": "CVE-2026-58015",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-58015",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58015.json",
"dateUpdated": "2026-10-12T20:58:45.624Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T20:50:41.753Z",
"numberOfChanges": 10,
"new": [
{
"cveId": "CVE-2026-108930",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108930",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108930.json",
"dateUpdated": "2026-10-12T20:45:12.622Z"
},
{
"cveId": "CVE-2026-53997",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-53997",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53997.json",
"dateUpdated": "2026-10-12T20:48:31.361Z"
},
{
"cveId": "CVE-2026-84314",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84314",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84314.json",
"dateUpdated": "2026-10-12T20:47:51.561Z"
},
{
"cveId": "CVE-2026-84320",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84320",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84320.json",
"dateUpdated": "2026-10-12T20:44:39.471Z"
},
{
"cveId": "CVE-2026-84321",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84321",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84321.json",
"dateUpdated": "2026-10-12T20:49:36.955Z"
}
],
"updated": [
{
"cveId": "CVE-2026-104077",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104077",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104077.json",
"dateUpdated": "2026-10-12T20:38:18.179Z"
},
{
"cveId": "CVE-2026-104078",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104078",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104078.json",
"dateUpdated": "2026-10-12T20:38:39.389Z"
},
{
"cveId": "CVE-2026-13201",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-13201",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/13xxx/CVE-2026-13201.json",
"dateUpdated": "2026-10-12T20:47:23.283Z"
},
{
"cveId": "CVE-2026-18378",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18378",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18378.json",
"dateUpdated": "2026-10-12T20:41:18.377Z"
},
{
"cveId": "CVE-2026-18381",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18381",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18381.json",
"dateUpdated": "2026-10-12T20:41:18.535Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T20:36:35.942Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2026-108929",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108929",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108929.json",
"dateUpdated": "2026-10-12T20:30:18.334Z"
},
{
"cveId": "CVE-2026-109426",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109426",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109426.json",
"dateUpdated": "2026-10-12T20:34:18.671Z"
},
{
"cveId": "CVE-2026-109427",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109427",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109427.json",
"dateUpdated": "2026-10-12T20:35:49.858Z"
},
{
"cveId": "CVE-2026-84318",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84318",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84318.json",
"dateUpdated": "2026-10-12T20:20:18.595Z"
}
],
"updated": [
{
"cveId": "CVE-2024-33396",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-33396",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/33xxx/CVE-2024-33396.json",
"dateUpdated": "2026-10-12T20:23:20.835Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T20:20:04.449Z",
"numberOfChanges": 12,
"new": [
{
"cveId": "CVE-2026-106495",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-106495",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106495.json",
"dateUpdated": "2026-10-12T20:11:07.680Z"
},
{
"cveId": "CVE-2026-108927",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108927",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108927.json",
"dateUpdated": "2026-10-12T20:00:17.398Z"
},
{
"cveId": "CVE-2026-108928",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108928",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108928.json",
"dateUpdated": "2026-10-12T20:15:14.118Z"
},
{
"cveId": "CVE-2026-41504",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-41504",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41504.json",
"dateUpdated": "2026-10-12T19:59:45.696Z"
},
{
"cveId": "CVE-2026-41508",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-41508",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41508.json",
"dateUpdated": "2026-10-12T20:01:09.451Z"
},
{
"cveId": "CVE-2026-84315",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-84315",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84315.json",
"dateUpdated": "2026-10-12T20:06:50.499Z"
},
{
"cveId": "CVE-2026-92116",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92116",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92116.json",
"dateUpdated": "2026-10-12T20:04:28.948Z"
},
{
"cveId": "CVE-2026-92119",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92119",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92119.json",
"dateUpdated": "2026-10-12T20:06:52.868Z"
},
{
"cveId": "CVE-2026-92120",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-92120",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92120.json",
"dateUpdated": "2026-10-12T20:08:15.489Z"
},
{
"cveId": "CVE-2026-97691",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97691",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97691.json",
"dateUpdated": "2026-10-12T20:15:02.873Z"
}
],
"updated": [
{
"cveId": "CVE-2025-6021",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-6021",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6021.json",
"dateUpdated": "2026-10-12T20:14:44.692Z"
},
{
"cveId": "CVE-2026-86320",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-86320",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86320.json",
"dateUpdated": "2026-10-12T20:09:09.748Z"
}
],
"error": []
}
]
state/sync.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"source": "https://github.com/CVEProject/cvelistV5.git",
"upstream_commit": "41627ee2ef1e12fad3ca94db3782ad3357a41e4f",
"upstream_commit": "6bd5b856aa81f101b3fd43fa4d22c31013aa399b",
"since_year": 2017,
"records": 331151,
"synced_at_utc": "2026-11-11T21:04:45.683591+00:00"
"records": 331183,
"synced_at_utc": "2026-11-11T21:29:06.400163+00:00"
}