VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-13T21:31:08Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-13 22:31:13 +01:00
1 parent 8f6feb24ee
commit aa65f0c147
117 files changed
+6532 -1384
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2024/58xxx/CVE-2024-58406.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T15:50:11.408Z",
"datePublished": "2026-11-13T15:57:13.779Z",
"dateUpdated": "2026-11-13T15:57:13.779Z"
"dateUpdated": "2026-11-13T21:08:12.948Z"
},
"containers": {
"cna": {
@@ -146,6 +146,40 @@
"x_generator": {
"engine": "vulncheck"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:08:04.608383Z",
"id": "CVE-2024-58406",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:08:12.948Z"
}
}
]
}
}
data/2025/41xxx/CVE-2025-41725.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CERTVDE",
"dateReserved": "2025-04-16T11:17:48.318Z",
"datePublished": "2026-11-13T12:59:24.549Z",
"dateUpdated": "2026-11-13T15:03:50.513Z"
"dateUpdated": "2026-11-13T21:01:59.702Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:01:50.713795Z",
"id": "CVE-2025-41725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:01:59.702Z"
}
}
]
}
}
data/2025/43xxx/CVE-2025-43867.json
+162
View File
@@ -0,0 +1,162 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-43867",
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"state": "PUBLISHED",
"assignerShortName": "jci",
"dateReserved": "2025-04-17T20:07:25.121Z",
"datePublished": "2026-11-13T20:14:16.172Z",
"dateUpdated": "2026-11-13T20:14:16.172Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci",
"dateUpdated": "2026-11-13T20:14:16.172Z"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-1395",
"description": "CWE-1395 - Dependency on Vulnerable Third-Party Component",
"type": "CWE"
}
]
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "CAPEC‑17: Accessing, Modifying or Deleting Files"
}
]
}
],
"affected": [
{
"vendor": "Johnson Controls",
"product": "FX Server",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "14.10.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "14.14.1",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Johnson Controls",
"product": "FX80",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "14.14.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "14.14.1",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Johnson Controls",
"product": "FX90",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "14.10.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "14.14.1",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifying or Deleting Files.\n\nThis issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifying or Deleting Files.<p>This issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.</p>"
}
]
}
],
"references": [
{
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 8.5,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H"
}
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2025/71xxx/CVE-2025-71459.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-11T22:58:40.540Z",
"datePublished": "2026-11-13T09:37:02.598Z",
"dateUpdated": "2026-11-13T09:37:02.598Z"
"dateUpdated": "2026-11-13T20:34:31.062Z"
},
"containers": {
"cna": {
@@ -118,6 +118,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:34:21.054650Z",
"id": "CVE-2025-71459",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:34:31.062Z"
}
}
]
}
}
data/2025/71xxx/CVE-2025-71463.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T23:12:43.913Z",
"datePublished": "2026-11-13T09:36:59.897Z",
"dateUpdated": "2026-11-13T09:36:59.897Z"
"dateUpdated": "2026-11-13T20:35:14.393Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:34:57.242804Z",
"id": "CVE-2025-71463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:35:14.393Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107398.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-10-07T21:07:54.989Z",
"datePublished": "2026-11-13T17:52:33.232Z",
"dateUpdated": "2026-11-13T17:52:33.232Z"
"dateUpdated": "2026-11-13T21:16:37.531Z"
},
"containers": {
"cna": {
@@ -89,6 +89,40 @@
"advisory": "GHSA-h57f-c9j4-577x",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:16:26.920630Z",
"id": "CVE-2026-107398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:16:37.531Z"
}
}
]
}
}
data/2026/107xxx/CVE-2026-107525.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-08T10:04:10.615Z",
"datePublished": "2026-11-13T13:08:18.837Z",
"dateUpdated": "2026-11-13T13:08:18.837Z"
"dateUpdated": "2026-11-13T21:00:22.769Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:00:09.706976Z",
"id": "CVE-2026-107525",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:00:22.769Z"
}
}
]
}
}
data/2026/110xxx/CVE-2026-110697.json
+12 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-14T14:10:16.450Z",
"datePublished": "2026-11-11T17:06:13.261Z",
"dateUpdated": "2026-11-13T09:13:00.690Z"
"dateUpdated": "2026-11-13T20:50:43.548Z"
},
"containers": {
"cna": {
@@ -249,6 +249,16 @@
"cpe:/a:redhat:quay:3.9::el8"
]
},
{
"vendor": "Red Hat",
"product": "mirror registry for Red Hat OpenShift 2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/mirror-registry-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:mirror_registry:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Quay 5",
@@ -385,7 +395,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-13T09:13:00.690Z"
"dateUpdated": "2026-11-13T20:50:43.548Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/113xxx/CVE-2026-113963.json
+18 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.480Z",
"datePublished": "2026-11-09T20:27:59.961Z",
"dateUpdated": "2026-11-12T21:46:05.376Z"
"dateUpdated": "2026-11-13T20:33:38.462Z"
},
"containers": {
"cna": {
@@ -47,6 +47,18 @@
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "27.2.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
@@ -75,13 +87,16 @@
"descriptions": [
{
"lang": "en",
"value": "An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data."
"value": "An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, tvOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data."
}
],
"references": [
{
"url": "https://support.apple.com/en-us/149715"
},
{
"url": "https://support.apple.com/en-us/149721"
},
{
"url": "https://support.apple.com/en-us/149722"
},
@@ -95,7 +110,7 @@
"providerMetadata": {
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple",
"dateUpdated": "2026-11-12T21:46:05.376Z"
"dateUpdated": "2026-11-13T20:33:38.462Z"
}
},
"adp": [
data/2026/113xxx/CVE-2026-113964.json
+18 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.480Z",
"datePublished": "2026-11-09T20:28:00.168Z",
"dateUpdated": "2026-11-12T21:46:05.600Z"
"dateUpdated": "2026-11-13T20:33:38.671Z"
},
"containers": {
"cna": {
@@ -83,6 +83,18 @@
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "27.2.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
@@ -117,7 +129,7 @@
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction."
"value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction."
}
],
"references": [
@@ -139,6 +151,9 @@
{
"url": "https://support.apple.com/en-us/149720"
},
{
"url": "https://support.apple.com/en-us/149721"
},
{
"url": "https://support.apple.com/en-us/149722"
},
@@ -155,7 +170,7 @@
"providerMetadata": {
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple",
"dateUpdated": "2026-11-12T21:46:05.600Z"
"dateUpdated": "2026-11-13T20:33:38.671Z"
}
},
"adp": [
data/2026/113xxx/CVE-2026-113965.json
+18 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.480Z",
"datePublished": "2026-11-09T20:28:00.382Z",
"dateUpdated": "2026-11-12T21:46:05.847Z"
"dateUpdated": "2026-11-13T20:33:38.876Z"
},
"containers": {
"cna": {
@@ -83,6 +83,18 @@
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "27.2.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
@@ -117,7 +129,7 @@
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction."
"value": "This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction."
}
],
"references": [
@@ -139,6 +151,9 @@
{
"url": "https://support.apple.com/en-us/149720"
},
{
"url": "https://support.apple.com/en-us/149721"
},
{
"url": "https://support.apple.com/en-us/149722"
},
@@ -155,7 +170,7 @@
"providerMetadata": {
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple",
"dateUpdated": "2026-11-12T21:46:05.847Z"
"dateUpdated": "2026-11-13T20:33:38.876Z"
}
},
"adp": [
data/2026/113xxx/CVE-2026-113968.json
+18 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.481Z",
"datePublished": "2026-11-09T20:28:00.591Z",
"dateUpdated": "2026-11-12T21:46:06.082Z"
"dateUpdated": "2026-11-13T20:33:39.072Z"
},
"containers": {
"cna": {
@@ -83,6 +83,18 @@
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "27.2.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
@@ -117,7 +129,7 @@
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts."
"value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts."
}
],
"references": [
@@ -139,6 +151,9 @@
{
"url": "https://support.apple.com/en-us/149720"
},
{
"url": "https://support.apple.com/en-us/149721"
},
{
"url": "https://support.apple.com/en-us/149722"
},
@@ -155,7 +170,7 @@
"providerMetadata": {
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple",
"dateUpdated": "2026-11-12T21:46:06.082Z"
"dateUpdated": "2026-11-13T20:33:39.072Z"
}
},
"adp": [
data/2026/113xxx/CVE-2026-113969.json
+18 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.481Z",
"datePublished": "2026-11-09T20:28:00.897Z",
"dateUpdated": "2026-11-12T21:46:06.315Z"
"dateUpdated": "2026-11-13T20:33:39.313Z"
},
"containers": {
"cna": {
@@ -83,6 +83,18 @@
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "27.2.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
@@ -117,7 +129,7 @@
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts."
"value": "A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts."
}
],
"references": [
@@ -139,6 +151,9 @@
{
"url": "https://support.apple.com/en-us/149720"
},
{
"url": "https://support.apple.com/en-us/149721"
},
{
"url": "https://support.apple.com/en-us/149722"
},
@@ -155,7 +170,7 @@
"providerMetadata": {
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple",
"dateUpdated": "2026-11-12T21:46:06.315Z"
"dateUpdated": "2026-11-13T20:33:39.313Z"
}
},
"adp": [
data/2026/113xxx/CVE-2026-113970.json
+18 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apple",
"dateReserved": "2026-10-20T21:06:55.481Z",
"datePublished": "2026-11-09T20:28:01.101Z",
"dateUpdated": "2026-11-12T21:46:06.547Z"
"dateUpdated": "2026-11-13T20:33:39.523Z"
},
"containers": {
"cna": {
@@ -83,6 +83,18 @@
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "27.2.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
@@ -117,7 +129,7 @@
"descriptions": [
{
"lang": "en",
"value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory."
"value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory."
}
],
"references": [
@@ -139,6 +151,9 @@
{
"url": "https://support.apple.com/en-us/149720"
},
{
"url": "https://support.apple.com/en-us/149721"
},
{
"url": "https://support.apple.com/en-us/149722"
},
@@ -155,7 +170,7 @@
"providerMetadata": {
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple",
"dateUpdated": "2026-11-12T21:46:06.547Z"
"dateUpdated": "2026-11-13T20:33:39.523Z"
}
},
"adp": [
data/2026/114xxx/CVE-2026-114713.json
+19 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mitre",
"dateReserved": "2026-10-22T00:56:41.381Z",
"datePublished": "2026-11-08T02:31:48.387Z",
"dateUpdated": "2026-11-13T19:25:14.456Z"
"dateUpdated": "2026-11-13T20:58:23.501Z"
},
"containers": {
"cna": {
@@ -182,6 +182,15 @@
"timestamp": "2026-11-13T19:16:29.356444Z"
}
}
},
{
"other": {
"type": "kev",
"content": {
"dateAdded": "2026-11-13",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713"
}
}
}
],
"references": [
@@ -196,8 +205,15 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T19:25:14.456Z"
}
"dateUpdated": "2026-11-13T20:58:23.501Z"
},
"timeline": [
{
"time": "2026-11-13T00:00:00.000Z",
"lang": "en",
"value": "CVE-2026-114713 added to CISA KEV"
}
]
}
]
}
data/2026/116xxx/CVE-2026-116323.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:13.913Z",
"dateUpdated": "2026-11-12T14:15:13.913Z"
"dateUpdated": "2026-11-13T20:28:25.137Z"
},
"containers": {
"cna": {
@@ -106,6 +106,40 @@
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:28:12.666825Z",
"id": "CVE-2026-116323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:28:25.137Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116326.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:15.067Z",
"dateUpdated": "2026-11-12T14:15:15.067Z"
"dateUpdated": "2026-11-13T20:27:12.458Z"
},
"containers": {
"cna": {
@@ -106,6 +106,40 @@
"value": "The PostgreSQL project thanks Dwij Mehta, Ngoc Trần, and Anthropic OSS program for reporting this problem."
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:26:46.216443Z",
"id": "CVE-2026-116326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:27:12.458Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116328.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:16.239Z",
"dateUpdated": "2026-11-12T14:15:16.239Z"
"dateUpdated": "2026-11-13T20:25:16.827Z"
},
"containers": {
"cna": {
@@ -88,6 +88,40 @@
"value": "The PostgreSQL project thanks Jayden Sarveshkumar for reporting this problem."
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:24:56.822534Z",
"id": "CVE-2026-116328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:25:16.827Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116329.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:16.818Z",
"dateUpdated": "2026-11-12T14:15:16.818Z"
"dateUpdated": "2026-11-13T20:24:00.000Z"
},
"containers": {
"cna": {
@@ -82,6 +82,40 @@
"value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem."
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:23:47.889772Z",
"id": "CVE-2026-116329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:24:00.000Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116330.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:17.385Z",
"dateUpdated": "2026-11-12T14:15:17.385Z"
"dateUpdated": "2026-11-13T20:22:53.399Z"
},
"containers": {
"cna": {
@@ -112,6 +112,40 @@
"value": "The PostgreSQL project thanks Pavel Kopylov for reporting this problem."
}
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:22:37.964637Z",
"id": "CVE-2026-116330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:22:53.399Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116411.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "dell",
"dateReserved": "2026-10-26T10:04:27.242Z",
"datePublished": "2026-11-13T14:03:41.940Z",
"dateUpdated": "2026-11-13T14:03:41.940Z"
"dateUpdated": "2026-11-13T21:03:42.346Z"
},
"containers": {
"cna": {
@@ -279,6 +279,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:03:33.585939Z",
"id": "CVE-2026-116411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:03:42.346Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120804.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:13.381Z",
"datePublished": "2026-11-10T20:03:44.297Z",
"dateUpdated": "2026-11-10T20:03:44.297Z"
"dateUpdated": "2026-11-13T21:04:52.733Z"
},
"containers": {
"cna": {
@@ -145,6 +145,40 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:00:04.358841Z",
"id": "CVE-2026-120804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:04:52.733Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120806.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:16.355Z",
"datePublished": "2026-11-10T20:05:18.025Z",
"dateUpdated": "2026-11-10T20:05:18.025Z"
"dateUpdated": "2026-11-13T20:59:24.084Z"
},
"containers": {
"cna": {
@@ -145,6 +145,40 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:59:13.971288Z",
"id": "CVE-2026-120806",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:59:24.084Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120807.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:17.417Z",
"datePublished": "2026-11-10T20:06:29.243Z",
"dateUpdated": "2026-11-10T20:06:29.243Z"
"dateUpdated": "2026-11-13T20:58:27.123Z"
},
"containers": {
"cna": {
@@ -145,6 +145,48 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-130169",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:58:20.653578Z",
"id": "CVE-2026-120807",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:58:27.123Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120814.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:26.669Z",
"datePublished": "2026-11-10T20:12:13.822Z",
"dateUpdated": "2026-11-10T20:12:13.822Z"
"dateUpdated": "2026-11-13T20:15:47.198Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:15:34.501270Z",
"id": "CVE-2026-120814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:15:47.198Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120815.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:28.946Z",
"datePublished": "2026-11-10T20:13:00.772Z",
"dateUpdated": "2026-11-10T20:13:00.772Z"
"dateUpdated": "2026-11-13T20:27:53.960Z"
},
"containers": {
"cna": {
@@ -145,6 +145,48 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-134872",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:27:49.289198Z",
"id": "CVE-2026-120815",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:27:53.960Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120819.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:36.448Z",
"datePublished": "2026-11-10T20:24:31.890Z",
"dateUpdated": "2026-11-10T20:24:31.890Z"
"dateUpdated": "2026-11-13T20:36:13.204Z"
},
"containers": {
"cna": {
@@ -127,6 +127,40 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:36:03.651730Z",
"id": "CVE-2026-120819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:36:13.204Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120823.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:41.853Z",
"datePublished": "2026-11-10T20:19:49.394Z",
"dateUpdated": "2026-11-10T20:19:49.394Z"
"dateUpdated": "2026-11-13T20:35:00.695Z"
},
"containers": {
"cna": {
@@ -127,6 +127,40 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:34:51.506760Z",
"id": "CVE-2026-120823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:35:00.695Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120825.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:46.452Z",
"datePublished": "2026-11-10T20:21:20.207Z",
"dateUpdated": "2026-11-10T20:21:20.207Z"
"dateUpdated": "2026-11-13T20:32:39.390Z"
},
"containers": {
"cna": {
@@ -130,6 +130,48 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-136876",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:32:30.370273Z",
"id": "CVE-2026-120825",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:32:39.390Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120826.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "mongodb",
"dateReserved": "2026-11-02T22:54:48.740Z",
"datePublished": "2026-11-10T20:22:04.078Z",
"dateUpdated": "2026-11-10T20:22:04.078Z"
"dateUpdated": "2026-11-13T20:33:49.621Z"
},
"containers": {
"cna": {
@@ -127,6 +127,40 @@
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:33:39.830014Z",
"id": "CVE-2026-120826",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:33:49.621Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123039.json
+19 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "checkpoint",
"dateReserved": "2026-11-05T07:30:18.138Z",
"datePublished": "2026-11-12T14:02:13.665Z",
"dateUpdated": "2026-11-13T19:25:14.608Z"
"dateUpdated": "2026-11-13T20:58:23.802Z"
},
"containers": {
"cna": {
@@ -146,6 +146,15 @@
"timestamp": "2026-11-13T19:16:35.345993Z"
}
}
},
{
"other": {
"type": "kev",
"content": {
"dateAdded": "2026-11-13",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039"
}
}
}
],
"references": [
@@ -160,8 +169,15 @@
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T19:25:14.608Z"
}
"dateUpdated": "2026-11-13T20:58:23.802Z"
},
"timeline": [
{
"time": "2026-11-13T00:00:00.000Z",
"lang": "en",
"value": "CVE-2026-123039 added to CISA KEV"
}
]
}
]
}
data/2026/123xxx/CVE-2026-123710.json
+12 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-06T10:23:55.509Z",
"datePublished": "2026-11-11T15:02:31.341Z",
"dateUpdated": "2026-11-13T14:18:08.901Z"
"dateUpdated": "2026-11-13T20:50:57.503Z"
},
"containers": {
"cna": {
@@ -249,6 +249,16 @@
"cpe:/a:redhat:quay:3.9::el8"
]
},
{
"vendor": "Red Hat",
"product": "mirror registry for Red Hat OpenShift 2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/mirror-registry-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:mirror_registry:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Quay 5",
@@ -385,7 +395,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-13T00:21:58.960Z"
"dateUpdated": "2026-11-13T20:50:57.503Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124016.json
+7 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-06T18:38:38.544Z",
"datePublished": "2026-11-10T19:22:30.485Z",
"dateUpdated": "2026-11-10T21:03:45.609Z"
"dateUpdated": "2026-11-13T20:29:09.130Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-10T19:22:30.485Z"
"dateUpdated": "2026-11-13T20:29:09.130Z"
},
"title": "postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine",
"descriptions": [
@@ -144,6 +144,11 @@
"lang": "en",
"value": "Arjun Jain",
"type": "finder"
},
{
"lang": "en",
"value": "Mohd Absar Ansari",
"type": "finder"
}
],
"x_generator": {
data/2026/124xxx/CVE-2026-124412.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-08T00:26:41.330Z",
"datePublished": "2026-11-13T14:40:28.529Z",
"dateUpdated": "2026-11-13T14:41:28.379Z"
"dateUpdated": "2026-11-13T21:04:23.442Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:04:14.336478Z",
"id": "CVE-2026-124412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:04:23.442Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125440.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T00:26:46.521Z",
"datePublished": "2026-11-13T14:41:09.092Z",
"dateUpdated": "2026-11-13T14:41:17.329Z"
"dateUpdated": "2026-11-13T21:04:45.839Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:04:35.072473Z",
"id": "CVE-2026-125440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:04:45.839Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125801.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.986Z",
"datePublished": "2026-11-13T13:05:08.445Z",
"dateUpdated": "2026-11-13T13:05:33.407Z"
"dateUpdated": "2026-11-13T21:02:48.967Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:02:41.045962Z",
"id": "CVE-2026-125801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:02:48.967Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125814.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.988Z",
"datePublished": "2026-11-13T12:58:27.612Z",
"dateUpdated": "2026-11-13T14:30:05.493Z"
"dateUpdated": "2026-11-13T21:02:29.695Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:02:18.925992Z",
"id": "CVE-2026-125814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:02:29.695Z"
}
}
]
}
}
data/2026/125xxx/CVE-2026-125821.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "Patchstack",
"dateReserved": "2026-11-10T12:37:30.990Z",
"datePublished": "2026-11-13T14:40:09.916Z",
"dateUpdated": "2026-11-13T14:41:13.773Z"
"dateUpdated": "2026-11-13T21:04:00.786Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"tags": [
"x_open-source"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:03:52.838671Z",
"id": "CVE-2026-125821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:04:00.786Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126267.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:49.116Z",
"dateUpdated": "2026-11-13T09:36:49.116Z"
"dateUpdated": "2026-11-13T20:37:33.797Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:37:25.162643Z",
"id": "CVE-2026-126267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:37:33.797Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126271.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:13:22.557Z",
"datePublished": "2026-11-13T09:36:46.548Z",
"dateUpdated": "2026-11-13T09:36:46.548Z"
"dateUpdated": "2026-11-13T20:38:19.263Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:38:08.438317Z",
"id": "CVE-2026-126271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:38:19.263Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126275.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:43.720Z",
"dateUpdated": "2026-11-13T09:36:43.720Z"
"dateUpdated": "2026-11-13T20:38:58.822Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:38:47.604597Z",
"id": "CVE-2026-126275",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:38:58.822Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126279.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:40.988Z",
"dateUpdated": "2026-11-13T09:36:40.988Z"
"dateUpdated": "2026-11-13T20:39:25.596Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:39:15.720615Z",
"id": "CVE-2026-126279",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:39:25.596Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126283.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:14:15.972Z",
"datePublished": "2026-11-13T09:36:37.190Z",
"dateUpdated": "2026-11-13T09:36:37.190Z"
"dateUpdated": "2026-11-13T20:40:00.858Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:39:47.530554Z",
"id": "CVE-2026-126283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:40:00.858Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126287.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.178Z",
"datePublished": "2026-11-13T09:36:34.544Z",
"dateUpdated": "2026-11-13T09:36:34.544Z"
"dateUpdated": "2026-11-13T21:01:35.614Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:01:24.325002Z",
"id": "CVE-2026-126287",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:01:35.614Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126291.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:03.179Z",
"datePublished": "2026-11-13T09:36:31.871Z",
"dateUpdated": "2026-11-13T09:36:31.871Z"
"dateUpdated": "2026-11-13T20:40:37.581Z"
},
"containers": {
"cna": {
@@ -139,6 +139,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:40:22.240291Z",
"id": "CVE-2026-126291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:40:37.581Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126295.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:29.196Z",
"dateUpdated": "2026-11-13T09:36:29.196Z"
"dateUpdated": "2026-11-13T20:41:23.672Z"
},
"containers": {
"cna": {
@@ -146,6 +146,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:41:03.126005Z",
"id": "CVE-2026-126295",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:41:23.672Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126299.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.612Z",
"datePublished": "2026-11-13T09:36:26.544Z",
"dateUpdated": "2026-11-13T09:36:26.544Z"
"dateUpdated": "2026-11-13T20:41:58.817Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:41:49.316593Z",
"id": "CVE-2026-126299",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:41:58.817Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126303.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:15:54.613Z",
"datePublished": "2026-11-13T09:36:23.874Z",
"dateUpdated": "2026-11-13T09:36:23.874Z"
"dateUpdated": "2026-11-13T21:01:08.245Z"
},
"containers": {
"cna": {
@@ -145,6 +145,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-8fx7-8jr8-84rv",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:00:44.295232Z",
"id": "CVE-2026-126303",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:01:08.245Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126307.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:21.073Z",
"dateUpdated": "2026-11-13T09:36:21.073Z"
"dateUpdated": "2026-11-13T20:49:25.399Z"
},
"containers": {
"cna": {
@@ -144,6 +144,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:44:42.476633Z",
"id": "CVE-2026-126307",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:49:25.399Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126311.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:16:44.443Z",
"datePublished": "2026-11-13T09:36:18.274Z",
"dateUpdated": "2026-11-13T09:36:18.274Z"
"dateUpdated": "2026-11-13T20:44:08.862Z"
},
"containers": {
"cna": {
@@ -167,6 +167,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:43:46.448404Z",
"id": "CVE-2026-126311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:44:08.862Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126315.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:15.474Z",
"dateUpdated": "2026-11-13T09:36:15.474Z"
"dateUpdated": "2026-11-13T20:43:15.149Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:42:57.515075Z",
"id": "CVE-2026-126315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:43:15.149Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126319.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:12.691Z",
"dateUpdated": "2026-11-13T09:36:12.691Z"
"dateUpdated": "2026-11-13T20:42:34.401Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:42:24.862755Z",
"id": "CVE-2026-126319",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:42:34.401Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126323.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T20:18:40.992Z",
"datePublished": "2026-11-13T09:36:09.910Z",
"dateUpdated": "2026-11-13T09:36:09.910Z"
"dateUpdated": "2026-11-13T20:28:16.894Z"
},
"containers": {
"cna": {
@@ -146,6 +146,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-grxp-rj92-j8xr",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:27:47.750229Z",
"id": "CVE-2026-126323",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:28:16.894Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126372.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.549Z",
"datePublished": "2026-11-13T09:36:07.223Z",
"dateUpdated": "2026-11-13T09:36:07.223Z"
"dateUpdated": "2026-11-13T20:32:40.888Z"
},
"containers": {
"cna": {
@@ -134,6 +134,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:32:12.019157Z",
"id": "CVE-2026-126372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:32:40.888Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126376.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:25:31.550Z",
"datePublished": "2026-11-13T09:36:04.558Z",
"dateUpdated": "2026-11-13T09:36:04.558Z"
"dateUpdated": "2026-11-13T20:31:39.971Z"
},
"containers": {
"cna": {
@@ -128,6 +128,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-g7j8-g4xq-f232",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:31:15.869440Z",
"id": "CVE-2026-126376",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:31:39.971Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126380.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:26:25.841Z",
"datePublished": "2026-11-13T09:36:01.857Z",
"dateUpdated": "2026-11-13T09:36:01.857Z"
"dateUpdated": "2026-11-13T20:30:48.952Z"
},
"containers": {
"cna": {
@@ -147,6 +147,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-hcpj-pcpx-2744",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:30:22.567467Z",
"id": "CVE-2026-126380",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:30:48.952Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126384.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:26:25.841Z",
"datePublished": "2026-11-13T09:35:59.112Z",
"dateUpdated": "2026-11-13T09:35:59.112Z"
"dateUpdated": "2026-11-13T20:29:55.203Z"
},
"containers": {
"cna": {
@@ -250,6 +250,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:29:42.541878Z",
"id": "CVE-2026-126384",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:29:55.203Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126388.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:26:25.842Z",
"datePublished": "2026-11-13T09:35:56.306Z",
"dateUpdated": "2026-11-13T09:35:56.306Z"
"dateUpdated": "2026-11-13T20:29:15.655Z"
},
"containers": {
"cna": {
@@ -210,6 +210,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:29:03.430158Z",
"id": "CVE-2026-126388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:29:15.655Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126392.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:30:16.910Z",
"datePublished": "2026-11-13T09:35:53.670Z",
"dateUpdated": "2026-11-13T09:35:53.670Z"
"dateUpdated": "2026-11-13T20:23:17.302Z"
},
"containers": {
"cna": {
@@ -166,6 +166,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:23:03.905458Z",
"id": "CVE-2026-126392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:23:17.302Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126396.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:30:16.910Z",
"datePublished": "2026-11-13T09:35:50.950Z",
"dateUpdated": "2026-11-13T11:44:37.122Z"
"dateUpdated": "2026-11-13T20:27:21.640Z"
},
"containers": {
"cna": {
@@ -164,6 +164,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:27:09.832988Z",
"id": "CVE-2026-126396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:27:21.640Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126400.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:32:21.764Z",
"datePublished": "2026-11-13T09:35:48.368Z",
"dateUpdated": "2026-11-13T09:35:48.368Z"
"dateUpdated": "2026-11-13T20:26:37.816Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:26:24.328891Z",
"id": "CVE-2026-126400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:26:37.816Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126404.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:32:21.765Z",
"datePublished": "2026-11-13T09:35:45.631Z",
"dateUpdated": "2026-11-13T09:35:45.631Z"
"dateUpdated": "2026-11-13T20:26:01.693Z"
},
"containers": {
"cna": {
@@ -321,6 +321,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:25:47.107888Z",
"id": "CVE-2026-126404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:26:01.693Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126408.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:32:21.765Z",
"datePublished": "2026-11-13T09:35:42.943Z",
"dateUpdated": "2026-11-13T09:35:42.943Z"
"dateUpdated": "2026-11-13T20:25:12.084Z"
},
"containers": {
"cna": {
@@ -204,6 +204,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:24:29.977618Z",
"id": "CVE-2026-126408",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:25:12.084Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126412.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:34:05.396Z",
"datePublished": "2026-11-13T09:35:39.219Z",
"dateUpdated": "2026-11-13T09:35:39.219Z"
"dateUpdated": "2026-11-13T20:23:56.740Z"
},
"containers": {
"cna": {
@@ -152,6 +152,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:23:39.799081Z",
"id": "CVE-2026-126412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:23:56.740Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126424.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-10T21:36:07.090Z",
"datePublished": "2026-11-13T09:35:31.004Z",
"dateUpdated": "2026-11-13T09:35:31.004Z"
"dateUpdated": "2026-11-13T20:13:57.502Z"
},
"containers": {
"cna": {
@@ -139,6 +139,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-qv97-cvw6-8j53",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T20:13:15.416511Z",
"id": "CVE-2026-126424",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T20:13:57.502Z"
}
}
]
}
}
data/2026/127xxx/CVE-2026-127216.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127216",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T16:30:10.904Z",
"datePublished": "2026-11-13T20:41:10.804Z",
"dateUpdated": "2026-11-13T20:41:10.804Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T20:41:10.804Z"
},
"title": "Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure",
"descriptions": [
{
"lang": "en",
"value": "Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_settings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking."
}
],
"tags": [
"x_open-source"
],
"datePublic": "2026-11-13T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Cross-Site Request Forgery (CSRF)",
"cweId": "CWE-352",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "Fahad Mahmood",
"product": "Injection Guard",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThan": "1.4.0"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"version": "3.1",
"baseSeverity": "MEDIUM",
"baseScore": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
}
],
"references": [
{
"url": "https://wordpress.org/plugins/injection-guard/#developers",
"name": "WordPress Changelog",
"tags": [
"release-notes",
"patch"
]
},
{
"url": "https://www.vulncheck.com/advisories/injection-guard-wordpress-plugin-csrf-password-hash-disclosure",
"name": "VulnCheck Advisory: Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "buiih",
"type": "reporter"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2026/127xxx/CVE-2026-127217.json
+145
View File
@@ -0,0 +1,145 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127217",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"state": "PUBLISHED",
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-12T16:30:10.904Z",
"datePublished": "2026-11-13T21:03:19.812Z",
"dateUpdated": "2026-11-13T21:03:19.812Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-11-13T21:03:19.812Z"
},
"title": "Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route",
"descriptions": [
{
"lang": "en",
"value": "Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server."
}
],
"tags": [
"x_open-source"
],
"datePublic": "2026-11-12T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Server-Side Request Forgery (SSRF)",
"cweId": "CWE-918",
"type": "CWE"
}
]
}
],
"affected": [
{
"defaultStatus": "unaffected",
"vendor": "Koen Reus",
"product": "Post to Google My Business (Google Business Profile)",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThan": "3.5.7"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"version": "3.1",
"baseSeverity": "MEDIUM",
"baseScore": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
}
],
"references": [
{
"url": "https://wordpress.org/plugins/post-to-google-my-business/#developers",
"name": "WordPress Changelog",
"tags": [
"release-notes",
"patch"
]
},
{
"url": "https://www.vulncheck.com/advisories/post-to-google-my-business-wordpress-plugin-ssrf-via-preview-rest-route",
"name": "VulnCheck Advisory: Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route",
"tags": [
"third-party-advisory"
]
}
],
"credits": [
{
"lang": "en",
"value": "buiih",
"type": "finder"
}
],
"x_generator": {
"engine": "vulncheck"
}
}
}
}
data/2026/128xxx/CVE-2026-128070.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.129Z",
"datePublished": "2026-11-13T17:20:27.855Z",
"dateUpdated": "2026-11-13T17:20:27.855Z"
"dateUpdated": "2026-11-13T21:09:22.550Z"
},
"containers": {
"cna": {
@@ -103,6 +103,40 @@
"advisory": "GHSA-mjrq-cffv-q4qc",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:09:14.953060Z",
"id": "CVE-2026-128070",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:09:22.550Z"
}
}
]
}
}
data/2026/128xxx/CVE-2026-128075.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.130Z",
"datePublished": "2026-11-13T17:36:17.283Z",
"dateUpdated": "2026-11-13T17:36:17.283Z"
"dateUpdated": "2026-11-13T21:16:08.311Z"
},
"containers": {
"cna": {
@@ -93,6 +93,40 @@
"advisory": "GHSA-96x6-fvhx-49hg",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:15:59.126778Z",
"id": "CVE-2026-128075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:16:08.311Z"
}
}
]
}
}
data/2026/128xxx/CVE-2026-128082.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.130Z",
"datePublished": "2026-11-13T18:37:30.465Z",
"dateUpdated": "2026-11-13T18:37:30.465Z"
"dateUpdated": "2026-11-13T21:17:15.616Z"
},
"containers": {
"cna": {
@@ -111,6 +111,48 @@
"advisory": "GHSA-6vhm-j9h7-f9gh",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-6vhm-j9h7-f9gh",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:16:56.451187Z",
"id": "CVE-2026-128082",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:17:15.616Z"
}
}
]
}
}
data/2026/128xxx/CVE-2026-128087.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T21:24:51.131Z",
"datePublished": "2026-11-13T19:03:26.702Z",
"dateUpdated": "2026-11-13T19:03:26.702Z"
"dateUpdated": "2026-11-13T21:15:30.367Z"
},
"containers": {
"cna": {
@@ -110,6 +110,48 @@
"advisory": "GHSA-9264-jvgf-6w2f",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/Eugeny/russh/security/advisories/GHSA-9264-jvgf-6w2f",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:15:11.345733Z",
"id": "CVE-2026-128087",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:15:30.367Z"
}
}
]
}
}
data/2026/128xxx/CVE-2026-128100.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "HashiCorp",
"dateReserved": "2026-11-12T22:16:53.115Z",
"datePublished": "2026-11-13T20:10:09.065Z",
"dateUpdated": "2026-11-13T20:10:09.065Z"
"dateUpdated": "2026-11-13T21:10:55.961Z"
},
"containers": {
"cna": {
@@ -152,6 +152,40 @@
"discovery": "EXTERNAL"
},
"title": "Vault vulnerable to ACL deny bypass via case-variant auth method user and group names"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:10:47.532219Z",
"id": "CVE-2026-128100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:10:55.961Z"
}
}
]
}
}
data/2026/128xxx/CVE-2026-128124.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128124",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.031Z",
"datePublished": "2026-11-13T20:22:36.733Z",
"dateUpdated": "2026-11-13T20:22:36.733Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: Event loop stall in add_domain() wildcard matching",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"lang": "en",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jm3w-gw2p-xjfj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jm3w-gw2p-xjfj"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13943",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13943"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13945",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13945"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/766b882820da0651c84090e366a3b024b4a263c9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/766b882820da0651c84090e366a3b024b4a263c9"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:22:36.733Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain() converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long Host header that does not match. A remote attacker can repeatedly send such headers to a server configured with a multi-wildcard domain mask and stall the event loop. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-jm3w-gw2p-xjfj",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128125.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128125",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:25:56.650Z",
"dateUpdated": "2026-11-13T20:25:56.650Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: Unbounded cookie storage in client CookieJar",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1325",
"lang": "en",
"description": "CWE-1325: Improperly Controlled Sequential Memory Allocation",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5pv8-vvhc-h7jv"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13930",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13930"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13942",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13942"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:25:56.650Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-5pv8-vvhc-h7jv",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128126.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128126",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:27:57.071Z",
"dateUpdated": "2026-11-13T20:27:57.071Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: Too many URL-encoded form fields block the event loop",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"lang": "en",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xgw8-8ccx-rmqh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xgw8-8ccx-rmqh"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13738",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13738"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13741",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13741"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/8b0100572936df28977b9de8a6cc7e464c0b521e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/8b0100572936df28977b9de8a6cc7e464c0b521e"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:27:57.071Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does not limit the number of fields in a URL-encoded form body, and inserting many repeated keys into MultiDict takes quadratic time on the event loop. A remote attacker can send a form POST within client_max_size to a handler that calls Request.post() and block the event loop. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-xgw8-8ccx-rmqh",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128127.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128127",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:30:19.198Z",
"dateUpdated": "2026-11-13T20:30:19.198Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: Base64 multipart parts bypass client_max_size",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"lang": "en",
"description": "CWE-400: Uncontrolled Resource Consumption",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-24c4-3p7v-29cm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-24c4-3p7v-29cm"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13509",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13509"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13513",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13513"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/2d9c5c1062eff0034fb3ab120897a6c1b3ff7041",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/2d9c5c1062eff0034fb3ab120897a6c1b3ff7041"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:30:19.198Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_chunk() processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short Content-Length or a long run of whitespace can cause one call to read the remaining body into memory before the size check or spin on the event loop. A remote attacker can send such a multipart request to a handler that reads multipart data and bypass client_max_size. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-24c4-3p7v-29cm",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128128.json
+119
View File
@@ -0,0 +1,119 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128128",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:31:59.981Z",
"dateUpdated": "2026-11-13T20:31:59.981Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: WebSocket max_msg_size bypass via integer overflow",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3rp8-rxj8-mvjw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3rp8-rxj8-mvjw"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13415",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13415"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13494",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13494"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/8c8906a19f64e52ef6a7d44d65217eb3c5af413f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/8c8906a19f64e52ef6a7d44d65217eb3c5af413f"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:31:59.981Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the max_msg_size check to pass. A remote peer can send a small non-final fragment followed by an oversized message and cause unbounded memory consumption. The Python WebSocket reader is unaffected. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-3rp8-rxj8-mvjw",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128129.json
+122
View File
@@ -0,0 +1,122 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128129",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:33:45.088Z",
"dateUpdated": "2026-11-13T20:33:45.088Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: Unbounded buffering of data received during an upgrade request",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pw86-h8fm-j323",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pw86-h8fm-j323"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13501",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13501"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13511",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13511"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/c207cadb257e0959b192ffca0548eca8c71eb96a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/c207cadb257e0959b192ffca0548eca8c71eb96a"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:33:45.088Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-pw86-h8fm-j323",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128130.json
+132
View File
@@ -0,0 +1,132 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128130",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:35:38.626Z",
"dateUpdated": "2026-11-13T20:35:38.626Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: Pure-Python parser request replay and buffer growth behind a declined upgrade",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"lang": "en",
"description": "CWE-835: Loop with Unreachable Exit Condition",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-28qf-cpwq-vmc2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-28qf-cpwq-vmc2"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13356",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13356"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13360",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13360"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/72eaa429cf89b1e20212590f3e704444239569fb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/72eaa429cf89b1e20212590f3e704444239569fb"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:35:38.626Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined request queue is full, the pure-Python parser stores the unparsed remainder internally and also returns the same data to its caller. After a handler declines an upgrade request, the caller feeds the remainder back to the parser, causing the buffer to grow with each handled request and dispatching already-handled requests to the application again. The issue affects deployments using AIOHTTP_NO_EXTENSIONS or otherwise running without the standard C-extension wheel, and can cause excessive memory use and repeated request processing. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-28qf-cpwq-vmc2",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128131.json
+132
View File
@@ -0,0 +1,132 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128131",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:39:46.745Z",
"dateUpdated": "2026-11-13T20:39:46.745Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: Concatenated compressed streams cause excessive CPU use",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"lang": "en",
"description": "CWE-400: Uncontrolled Resource Consumption",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"lang": "en",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-h4cc-hm5h-fmm9"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13362",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13362"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13391",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13391"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/d041d4d0fd48c3f0832084d33be16cf1c4835f85"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:39:46.745Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty members produce no output, so client_max_size and output backpressure do not limit the work. A remote attacker can block a server event loop with a crafted compressed request body or WebSocket message, and a malicious server can similarly block a client. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-h4cc-hm5h-fmm9",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128132.json
+146
View File
@@ -0,0 +1,146 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128132",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-11-12T22:42:47.032Z",
"datePublished": "2026-11-13T20:42:17.871Z",
"dateUpdated": "2026-11-13T20:42:17.871Z"
},
"containers": {
"cna": {
"title": "AIOHTTP: WebSocket receive queue limits bypassed by small or compressed messages",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"lang": "en",
"description": "CWE-400: Uncontrolled Resource Consumption",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5rmc-48h2-hvcm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5rmc-48h2-hvcm"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13393",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13393"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13545",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13545"
},
{
"name": "https://github.com/aio-libs/aiohttp/pull/13546",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/pull/13546"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/5e54037933fa8422be5fa8a2002d118ed2d4e5e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/5e54037933fa8422be5fa8a2002d118ed2d4e5e0"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/b62321b6fa264a89f4aca084ad60fc38a59ffa51",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/b62321b6fa264a89f4aca084ad60fc38a59ffa51"
},
{
"name": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"
}
],
"affected": [
{
"vendor": "aio-libs",
"product": "aiohttp",
"versions": [
{
"version": "< 3.14.4",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:42:17.871Z"
},
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader continues parsing frames already received after the receive queue pauses the transport, and empty messages are not counted toward the queue size. With permessage-deflate, one read of compressed frames can add many megabytes of decompressed messages to the receive queue. A remote peer can send many small or compressed messages faster than the application consumes them and cause excessive memory use in a server or client. This issue is fixed in version 3.14.4."
}
],
"source": {
"advisory": "GHSA-5rmc-48h2-hvcm",
"discovery": "UNKNOWN"
}
}
}
}
data/2026/128xxx/CVE-2026-128133.json
+31
View File
@@ -0,0 +1,31 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128133",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "REJECTED",
"dateReserved": "2026-11-12T22:42:47.032Z",
"dateUpdated": "2026-11-13T20:45:24.020Z",
"dateRejected": "2026-11-13T20:45:24.020Z",
"assignerShortName": "GitHub_M"
},
"containers": {
"cna": {
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE is a duplicate of another CVE."
}
],
"replacedBy": [
"CVE-2026-126304"
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-11-13T20:45:24.020Z"
}
}
}
}
data/2026/128xxx/CVE-2026-128885.json
+121
View File
@@ -0,0 +1,121 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128885",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-13T11:51:21.521Z",
"datePublished": "2026-11-13T21:06:46.450Z",
"dateUpdated": "2026-11-13T21:06:46.450Z"
},
"containers": {
"cna": {
"title": "Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize",
"metrics": [
{
"other": {
"content": {
"value": "Moderate",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a large number of concurrent connections to trigger an out-of-bounds write on the stack. This can cause the daemon to crash, resulting in a Denial of Service (DoS)."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dbus",
"defaultStatus": "unknown",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-128885",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462795",
"name": "RHBZ#2462795",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-08-19T16:20:17.572Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-26T20:06:04.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-19T16:20:17.572Z",
"value": "Made public."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-13T21:06:46.450Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/128xxx/CVE-2026-128987.json
+121
View File
@@ -0,0 +1,121 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-128987",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-11-13T14:11:49.656Z",
"datePublished": "2026-11-13T21:06:55.820Z",
"dateUpdated": "2026-11-13T21:06:55.820Z"
},
"containers": {
"cna": {
"title": "Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations",
"metrics": [
{
"other": {
"content": {
"value": "Moderate",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dbus",
"defaultStatus": "unknown",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-128987",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462869",
"name": "RHBZ#2462869",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
}
],
"datePublic": "2026-08-19T16:20:17.572Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-835: Loop with Unreachable Exit Condition",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-26T20:18:03.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-19T16:20:17.572Z",
"value": "Made public."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-13T21:06:55.820Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/2026/128xxx/CVE-2026-128991.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T14:31:49.944Z",
"datePublished": "2026-11-13T15:01:41.369Z",
"dateUpdated": "2026-11-13T15:01:41.369Z"
"dateUpdated": "2026-11-13T21:05:14.655Z"
},
"containers": {
"cna": {
@@ -130,6 +130,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:05:06.274545Z",
"id": "CVE-2026-128991",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:05:14.655Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129099.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T15:31:00.206Z",
"datePublished": "2026-11-13T15:38:32.150Z",
"dateUpdated": "2026-11-13T15:38:32.150Z"
"dateUpdated": "2026-11-13T21:06:21.146Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:06:12.186428Z",
"id": "CVE-2026-129099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:06:21.146Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129103.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T15:31:00.206Z",
"datePublished": "2026-11-13T15:38:29.548Z",
"dateUpdated": "2026-11-13T15:38:29.548Z"
"dateUpdated": "2026-11-13T21:03:18.157Z"
},
"containers": {
"cna": {
@@ -122,6 +122,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:03:09.734127Z",
"id": "CVE-2026-129103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:03:18.157Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129119.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T16:00:59.324Z",
"datePublished": "2026-11-13T16:23:46.712Z",
"dateUpdated": "2026-11-13T16:23:46.712Z"
"dateUpdated": "2026-11-13T21:12:21.062Z"
},
"containers": {
"cna": {
@@ -142,6 +142,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:11:59.470857Z",
"id": "CVE-2026-129119",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:12:21.062Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129123.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T16:01:00.787Z",
"datePublished": "2026-11-13T16:23:43.967Z",
"dateUpdated": "2026-11-13T16:23:43.967Z"
"dateUpdated": "2026-11-13T21:11:40.850Z"
},
"containers": {
"cna": {
@@ -148,6 +148,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:11:22.241547Z",
"id": "CVE-2026-129123",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:11:40.850Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129127.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T16:01:02.227Z",
"datePublished": "2026-11-13T16:23:41.139Z",
"dateUpdated": "2026-11-13T16:23:41.139Z"
"dateUpdated": "2026-11-13T21:11:02.627Z"
},
"containers": {
"cna": {
@@ -148,6 +148,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:10:53.764446Z",
"id": "CVE-2026-129127",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:11:02.627Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129131.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T16:01:03.677Z",
"datePublished": "2026-11-13T16:23:36.890Z",
"dateUpdated": "2026-11-13T16:23:36.890Z"
"dateUpdated": "2026-11-13T21:10:34.927Z"
},
"containers": {
"cna": {
@@ -155,6 +155,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:10:27.213894Z",
"id": "CVE-2026-129131",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:10:34.927Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129135.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T16:01:05.142Z",
"datePublished": "2026-11-13T16:23:34.108Z",
"dateUpdated": "2026-11-13T16:23:34.108Z"
"dateUpdated": "2026-11-13T21:05:55.068Z"
},
"containers": {
"cna": {
@@ -172,6 +172,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:05:47.021998Z",
"id": "CVE-2026-129135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:05:55.068Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129152.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T17:03:17.186Z",
"datePublished": "2026-11-13T17:22:05.248Z",
"dateUpdated": "2026-11-13T17:22:05.248Z"
"dateUpdated": "2026-11-13T21:13:12.274Z"
},
"containers": {
"cna": {
@@ -154,6 +154,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:13:04.156902Z",
"id": "CVE-2026-129152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:13:12.274Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129156.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T17:03:18.564Z",
"datePublished": "2026-11-13T17:22:02.375Z",
"dateUpdated": "2026-11-13T17:22:02.375Z"
"dateUpdated": "2026-11-13T21:14:46.139Z"
},
"containers": {
"cna": {
@@ -142,6 +142,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:14:38.744689Z",
"id": "CVE-2026-129156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:14:46.139Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129161.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T17:09:09.003Z",
"datePublished": "2026-11-13T17:21:55.247Z",
"dateUpdated": "2026-11-13T17:21:55.247Z"
"dateUpdated": "2026-11-13T21:14:24.139Z"
},
"containers": {
"cna": {
@@ -130,6 +130,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:14:15.248982Z",
"id": "CVE-2026-129161",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:14:24.139Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129165.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T17:10:57.587Z",
"datePublished": "2026-11-13T17:21:52.384Z",
"dateUpdated": "2026-11-13T17:21:52.384Z"
"dateUpdated": "2026-11-13T21:13:56.649Z"
},
"containers": {
"cna": {
@@ -154,6 +154,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:13:48.840438Z",
"id": "CVE-2026-129165",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:13:56.649Z"
}
}
]
}
}
data/2026/129xxx/CVE-2026-129169.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-13T17:11:54.526Z",
"datePublished": "2026-11-13T17:21:49.628Z",
"dateUpdated": "2026-11-13T17:21:49.628Z"
"dateUpdated": "2026-11-13T21:13:36.371Z"
},
"containers": {
"cna": {
@@ -142,6 +142,40 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:13:25.285322Z",
"id": "CVE-2026-129169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:13:36.371Z"
}
}
]
}
}
data/2026/20xxx/CVE-2026-20320.json
+4 -4
View File
@@ -8,19 +8,19 @@
"assignerShortName": "cisco",
"dateReserved": "2025-10-08T11:59:15.411Z",
"datePublished": "2026-08-19T16:39:04.920Z",
"dateUpdated": "2026-11-11T04:55:47.088Z"
"dateUpdated": "2026-11-13T20:49:01.482Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco",
"dateUpdated": "2026-08-19T16:39:04.920Z"
"dateUpdated": "2026-11-13T20:49:01.482Z"
},
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.\r\n\r This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface &ndash; Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user."
"value": "A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. \r\n\r This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface &ndash; Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user."
}
],
"affected": [
@@ -75,7 +75,7 @@
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
"value": "In November 2026, this vulnerability was added to the Known Exploited Vulnerability (KEV) database of the U.S. Cybersecurity and Infrastructure Security Agency (CISA)."
}
],
"source": {
data/2026/49xxx/CVE-2026-49990.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-06-02T18:30:51.282Z",
"datePublished": "2026-11-13T15:54:22.681Z",
"dateUpdated": "2026-11-13T15:54:22.681Z"
"dateUpdated": "2026-11-13T21:07:01.534Z"
},
"containers": {
"cna": {
@@ -100,6 +100,48 @@
"advisory": "GHSA-8759-hx7g-94qx",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:06:41.375503Z",
"id": "CVE-2026-49990",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:07:01.534Z"
}
}
]
}
}
data/2026/52xxx/CVE-2026-52790.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "GitHub_M",
"dateReserved": "2026-06-08T18:02:19.731Z",
"datePublished": "2026-11-13T15:57:10.497Z",
"dateUpdated": "2026-11-13T15:57:10.497Z"
"dateUpdated": "2026-11-13T21:07:45.249Z"
},
"containers": {
"cna": {
@@ -104,6 +104,48 @@
"advisory": "GHSA-jr7p-rm2x-739x",
"discovery": "UNKNOWN"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-13T21:07:26.266952Z",
"id": "CVE-2026-52790",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-13T21:07:45.249Z"
}
}
]
}
}
Loaded 100 of 117 files, more files were not shown because too many files have changed in this diff. Show more